791358686ec4557612787df04ecaabbca65cb9e1e5ef27df0c15c2494c9d255f

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

690232b783a00c2eff3c88689be7ad7e.exe
Size

60KB
MD5

690232b783a00c2eff3c88689be7ad7e
SHA1

2673201b05e39c09218c25311fc1e3bd7f0eeb09
SHA256

791358686ec4557612787df04ecaabbca65cb9e1e5ef27df0c15c2494c9d255f
SHA512

6bfbab23535592253e30714da235f396504f29f93f71f89437d7979b18486a2c71d00b7205ae5999ca679e8e55e4baaee892687ff8f1019bc5df2d0711d1a4d6
SSDEEP

768:KGSYvdPpl9Ch34h0uHFruF48iQpSlmpFPz4YXOc2/291Q5+n4ooMG7LNZRvt/2VZ:KuCUrARtj7lamQ5+4/D7b+l9l

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hyapbt\Parameters\ServiceDll = "%SystemRoot%\\System32\\ixbxbu.dll"	690232b783a00c2eff3c88689be7ad7e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\hyapbt\Parameters\ServiceDll = "%SystemRoot%\\System32\\ixbxbu.dll"	690232b783a00c2eff3c88689be7ad7e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\hyapbt\Parameters\ServiceDll = "%SystemRoot%\\System32\\ixbxbu.dll"	690232b783a00c2eff3c88689be7ad7e.exe

Deletes itself 1 IoCs

pid	Process
3004	SVCHOST.EXE

Loads dropped DLL 2 IoCs

pid	Process
1384	690232b783a00c2eff3c88689be7ad7e.exe
3004	SVCHOST.EXE

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ixbxbu.dll	690232b783a00c2eff3c88689be7ad7e.exe
File created	C:\Windows\SysWOW64\0004808e.sys	690232b783a00c2eff3c88689be7ad7e.exe
File opened for modification	C:\Windows\SysWOW64\0004808e.sys	690232b783a00c2eff3c88689be7ad7e.exe

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -k hyapbt
1⤵
- Deletes itself
- Loads dropped DLL
PID:3004

C:\Users\Admin\AppData\Local\Temp\690232b783a00c2eff3c88689be7ad7e.exe
"C:\Users\Admin\AppData\Local\Temp\690232b783a00c2eff3c88689be7ad7e.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ixbxbu.dll

Filesize
93KB

MD5
ae852d5598676c933022911a63ea33f1

SHA1
ca05893dfa1eaabc6c413db019710a98c4c07ed9

SHA256
9e19bbd718be4c64049a810778ad823f7495413db6cc6f33a726eadf96dab1db

SHA512
2ff3cfa1f7ea157b252b6669a2442a92de04a8e29d2fd9d44e0a672ea3fe84d015e375053a6dced140fdea6c69e177c9c855aefa7e71f20d2954a41d3d8a727a

Download Submit
memory/1384-5-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/3004-8-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/3004-9-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads