Analysis
-
max time kernel
169s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 18:00
Static task
static1
Behavioral task
behavioral1
Sample
70bdc622d4ecb4da6eb1d3a5f98652ab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70bdc622d4ecb4da6eb1d3a5f98652ab.exe
Resource
win10v2004-20231215-en
General
-
Target
70bdc622d4ecb4da6eb1d3a5f98652ab.exe
-
Size
90KB
-
MD5
70bdc622d4ecb4da6eb1d3a5f98652ab
-
SHA1
6be9177289178f1799ca1241a35e94d24089148e
-
SHA256
f82516c78483b315b21307bcbecd66273dfa1963f3ffa9d2609df6341e00a95e
-
SHA512
f04a3df175241f72c85c6eb4e447aebb8f8832d09327c9f80a661e318cb265bc7b7a0490575f9c80e3142e493fc95588d7cca4e4c230ce09b93ab535a6e66c39
-
SSDEEP
1536:804f1SMHjZ0k/tB1g//I0DuoxbxAHscmbiMKoEYP34B53FgAMKgNqpdcLc:ef1BDZ0kVB67Duw9AMcmbiMEeIb3PFgK
Malware Config
Extracted
systembc
80.85.84.79:4001
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
csxao.execsxao.execsxao.execsxao.exepid process 364 csxao.exe 1840 csxao.exe 876 csxao.exe 576 csxao.exe -
Loads dropped DLL 5 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.execsxao.execsxao.exepid process 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 364 csxao.exe 364 csxao.exe 876 csxao.exe 876 csxao.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip4.seeip.org 9 ip4.seeip.org 6 api.ipify.org 7 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in System32 directory 2 IoCs
Processes:
csxao.execsxao.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\523724207 csxao.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\523724207 csxao.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.execsxao.execsxao.exedescription pid process target process PID 2680 set thread context of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 364 set thread context of 1840 364 csxao.exe csxao.exe PID 876 set thread context of 576 876 csxao.exe csxao.exe -
Drops file in Windows directory 2 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.exedescription ioc process File opened for modification C:\Windows\Tasks\csxao.job 70bdc622d4ecb4da6eb1d3a5f98652ab.exe File created C:\Windows\Tasks\csxao.job 70bdc622d4ecb4da6eb1d3a5f98652ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\ProgramData\hrsrvt\csxao.exe nsis_installer_1 C:\ProgramData\hrsrvt\csxao.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.exepid process 2728 70bdc622d4ecb4da6eb1d3a5f98652ab.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.execsxao.execsxao.exepid process 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 364 csxao.exe 876 csxao.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
70bdc622d4ecb4da6eb1d3a5f98652ab.exetaskeng.execsxao.execsxao.exedescription pid process target process PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 2680 wrote to memory of 2728 2680 70bdc622d4ecb4da6eb1d3a5f98652ab.exe 70bdc622d4ecb4da6eb1d3a5f98652ab.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 364 1644 taskeng.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 364 wrote to memory of 1840 364 csxao.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 1644 wrote to memory of 876 1644 taskeng.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe PID 876 wrote to memory of 576 876 csxao.exe csxao.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70bdc622d4ecb4da6eb1d3a5f98652ab.exe"C:\Users\Admin\AppData\Local\Temp\70bdc622d4ecb4da6eb1d3a5f98652ab.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\70bdc622d4ecb4da6eb1d3a5f98652ab.exe"C:\Users\Admin\AppData\Local\Temp\70bdc622d4ecb4da6eb1d3a5f98652ab.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
C:\Windows\system32\taskeng.exetaskeng.exe {789E334C-9763-41FC-8160-C5ABD4A36664} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\ProgramData\hrsrvt\csxao.exeC:\ProgramData\hrsrvt\csxao.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:364 -
C:\ProgramData\hrsrvt\csxao.exeC:\ProgramData\hrsrvt\csxao.exe start3⤵
- Executes dropped EXE
PID:1840 -
C:\ProgramData\hrsrvt\csxao.exeC:\ProgramData\hrsrvt\csxao.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:876 -
C:\ProgramData\hrsrvt\csxao.exeC:\ProgramData\hrsrvt\csxao.exe start3⤵
- Executes dropped EXE
PID:576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD570bdc622d4ecb4da6eb1d3a5f98652ab
SHA16be9177289178f1799ca1241a35e94d24089148e
SHA256f82516c78483b315b21307bcbecd66273dfa1963f3ffa9d2609df6341e00a95e
SHA512f04a3df175241f72c85c6eb4e447aebb8f8832d09327c9f80a661e318cb265bc7b7a0490575f9c80e3142e493fc95588d7cca4e4c230ce09b93ab535a6e66c39
-
Filesize
48KB
MD5e2bcf3f4d1bf5cd55b8e2bcdea1bd3c5
SHA1e80cdb0628b45ccdd2cab2055d740f24116d89c0
SHA256636ea92e088c0deae15b2d6b60d5220882e6c6a758028686f65a285ee87b4a9c
SHA51241cb08ad69b0628bd853407fd28a1c612cfe06245f799dd9f01486500abe625c3e872c0a70e666b487e7b7e3556650c5e2e873f1d56dc5d2d893aed4f1d794f0
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c