Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
1796279f87df5f4d66030525b7e8e39c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1796279f87df5f4d66030525b7e8e39c.exe
Resource
win10v2004-20231215-en
General
-
Target
1796279f87df5f4d66030525b7e8e39c.exe
-
Size
13.8MB
-
MD5
1796279f87df5f4d66030525b7e8e39c
-
SHA1
a45b65e9060ca0d28fd2875b22b8540067db6832
-
SHA256
00a414b5c275653c18a3cc06ae1d1d9de9e07144f0a6091fa46f51e482a0dae6
-
SHA512
8b381fd38d8a538a408a29c70d2532403e36caadae46bf20b2f1786cbe1942c67ca310a4faab777b5c576062cd2ecf57c4edac5526cbf96a6e6dd413f2950b06
-
SSDEEP
3072:8kAgDr/XSqon0LUwWQ2UHxqms7/7btm52yls2LC5J8ZWwoQSwgeb7hiOiPg0tGif:8khDr/+0LUdbKhsMs268UoSwrb7SpG
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\oyrqvgil = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2896 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\oyrqvgil\ImagePath = "C:\\Windows\\SysWOW64\\oyrqvgil\\wahlnqgs.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2852 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2712 wahlnqgs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2712 set thread context of 2852 2712 wahlnqgs.exe 39 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2384 sc.exe 2780 sc.exe 2984 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2508 2496 1796279f87df5f4d66030525b7e8e39c.exe 26 PID 2496 wrote to memory of 2508 2496 1796279f87df5f4d66030525b7e8e39c.exe 26 PID 2496 wrote to memory of 2508 2496 1796279f87df5f4d66030525b7e8e39c.exe 26 PID 2496 wrote to memory of 2508 2496 1796279f87df5f4d66030525b7e8e39c.exe 26 PID 2496 wrote to memory of 2892 2496 1796279f87df5f4d66030525b7e8e39c.exe 31 PID 2496 wrote to memory of 2892 2496 1796279f87df5f4d66030525b7e8e39c.exe 31 PID 2496 wrote to memory of 2892 2496 1796279f87df5f4d66030525b7e8e39c.exe 31 PID 2496 wrote to memory of 2892 2496 1796279f87df5f4d66030525b7e8e39c.exe 31 PID 2496 wrote to memory of 2384 2496 1796279f87df5f4d66030525b7e8e39c.exe 33 PID 2496 wrote to memory of 2384 2496 1796279f87df5f4d66030525b7e8e39c.exe 33 PID 2496 wrote to memory of 2384 2496 1796279f87df5f4d66030525b7e8e39c.exe 33 PID 2496 wrote to memory of 2384 2496 1796279f87df5f4d66030525b7e8e39c.exe 33 PID 2496 wrote to memory of 2780 2496 1796279f87df5f4d66030525b7e8e39c.exe 35 PID 2496 wrote to memory of 2780 2496 1796279f87df5f4d66030525b7e8e39c.exe 35 PID 2496 wrote to memory of 2780 2496 1796279f87df5f4d66030525b7e8e39c.exe 35 PID 2496 wrote to memory of 2780 2496 1796279f87df5f4d66030525b7e8e39c.exe 35 PID 2496 wrote to memory of 2984 2496 1796279f87df5f4d66030525b7e8e39c.exe 37 PID 2496 wrote to memory of 2984 2496 1796279f87df5f4d66030525b7e8e39c.exe 37 PID 2496 wrote to memory of 2984 2496 1796279f87df5f4d66030525b7e8e39c.exe 37 PID 2496 wrote to memory of 2984 2496 1796279f87df5f4d66030525b7e8e39c.exe 37 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39 PID 2496 wrote to memory of 2896 2496 1796279f87df5f4d66030525b7e8e39c.exe 41 PID 2496 wrote to memory of 2896 2496 1796279f87df5f4d66030525b7e8e39c.exe 41 PID 2496 wrote to memory of 2896 2496 1796279f87df5f4d66030525b7e8e39c.exe 41 PID 2496 wrote to memory of 2896 2496 1796279f87df5f4d66030525b7e8e39c.exe 41 PID 2712 wrote to memory of 2852 2712 wahlnqgs.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oyrqvgil\2⤵PID:2508
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wahlnqgs.exe" C:\Windows\SysWOW64\oyrqvgil\2⤵PID:2892
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create oyrqvgil binPath= "C:\Windows\SysWOW64\oyrqvgil\wahlnqgs.exe /d\"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2384
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description oyrqvgil "wifi internet conection"2⤵
- Launches sc.exe
PID:2780
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start oyrqvgil2⤵
- Launches sc.exe
PID:2984
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2896
-
-
C:\Windows\SysWOW64\oyrqvgil\wahlnqgs.exeC:\Windows\SysWOW64\oyrqvgil\wahlnqgs.exe /d"C:\Users\Admin\AppData\Local\Temp\1796279f87df5f4d66030525b7e8e39c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2