9370ab4287b5d3820a0f843f47d860bec89791d945c2dcbc417f3d2640ccb761

Analysis

max time kernel
166s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c87309c69e759f1406bedad88c97dd7.exe
Size

62KB
MD5

0c87309c69e759f1406bedad88c97dd7
SHA1

73ff926a0cf4c45e759c7f75ca99405d78fd97fc
SHA256

9370ab4287b5d3820a0f843f47d860bec89791d945c2dcbc417f3d2640ccb761
SHA512

0a456257eccf0efca7205043d43307d96b56f2a78380ed020b477fbde3ee418a9260f73f8ceb77bfb7efe110b103b64bc775002e1589059d8bffcd1caee08a66
SSDEEP

1536:SJfGflXdrIKDlCJmdxV/Wrqz7hUJFpKWpD4TlqIx:CErIEemdLIQUpbpsRjx

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xsfxbj\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\wbfqpi.dll"	0c87309c69e759f1406bedad88c97dd7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\xsfxbj\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\wbfqpi.dll"	0c87309c69e759f1406bedad88c97dd7.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\xsfxbj\pARAMETERS\ServiceDll = "%SystemRoot%\\System32\\wbfqpi.dll"	0c87309c69e759f1406bedad88c97dd7.exe

Deletes itself 1 IoCs

pid	Process
216	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2444	0c87309c69e759f1406bedad88c97dd7.exe
216	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\00052d23.001	0c87309c69e759f1406bedad88c97dd7.exe
File created	C:\Windows\SysWOW64\wbfqpi.dll	0c87309c69e759f1406bedad88c97dd7.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
216	svchost.exe
216	svchost.exe
216	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0c87309c69e759f1406bedad88c97dd7.exe
"C:\Users\Admin\AppData\Local\Temp\0c87309c69e759f1406bedad88c97dd7.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2444

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k xsfxbj
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wbfqpi.dll

Filesize
89KB

MD5
2bd25355032dc3fc5db8c1e7ff337108

SHA1
e257641f45f9d910cc1f71d0056c121b53ef3b2a

SHA256
0e28fcd70ca27db2b4bd476841cb2eed4d4a75e35364388378089a4fee06aafb

SHA512
4b141d89f74a79566f069f3dd74283a14d912a5d29c8015da9f45b1cae6f9d4d14f2ce4541fdb030c6fdbb1dcc04a75c79927623379bb254c37e1c2ca083ed97

Download Submit
memory/2444-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2444-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads