Analysis
-
max time kernel
0s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 02:14
Static task
static1
Behavioral task
behavioral1
Sample
24252e6b573e398f3161fb58bdccce1b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
24252e6b573e398f3161fb58bdccce1b.exe
Resource
win10v2004-20231215-en
General
-
Target
24252e6b573e398f3161fb58bdccce1b.exe
-
Size
136KB
-
MD5
24252e6b573e398f3161fb58bdccce1b
-
SHA1
5964ee2c21cd3f331e1661f78df983a4dace6a29
-
SHA256
ea2efbc48f7257e184a90e50698640df4afccf383e977e1f21b3dedcd2040ae7
-
SHA512
4566b08f24bf3f2d913c3814c53ab7c515231b6bd0fe4adf1f0c3e7ae312342395e68b5c4c1184d424832ee4a55d25251b6fb8d763f7f5b626aa06dfcce4f921
-
SSDEEP
3072:zrnnbX8b3xcFKpcgtHonOkeD4eNhn8iTS2nIM64:zrz8bZpxtEOlD468i/IV
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ksqwt.exe 24252e6b573e398f3161fb58bdccce1b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ksqwt.exe 24252e6b573e398f3161fb58bdccce1b.exe -
Executes dropped EXE 1 IoCs
Processes:
mfbfgo.exepid process 2856 mfbfgo.exe -
Loads dropped DLL 2 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exepid process 2000 24252e6b573e398f3161fb58bdccce1b.exe 2000 24252e6b573e398f3161fb58bdccce1b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nrooxftv = "C:\\Users\\Admin\\AppData\\Local\\mfbfgo.exe" 24252e6b573e398f3161fb58bdccce1b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\nrooxftv = "C:\\Users\\Admin\\AppData\\Local\\mfbfgo.exe" 24252e6b573e398f3161fb58bdccce1b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exedescription pid process target process PID 3044 set thread context of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
24252e6b573e398f3161fb58bdccce1b.exe24252e6b573e398f3161fb58bdccce1b.exedescription pid process target process PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 3044 wrote to memory of 2000 3044 24252e6b573e398f3161fb58bdccce1b.exe 24252e6b573e398f3161fb58bdccce1b.exe PID 2000 wrote to memory of 2152 2000 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 2000 wrote to memory of 2152 2000 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 2000 wrote to memory of 2152 2000 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 2000 wrote to memory of 2152 2000 24252e6b573e398f3161fb58bdccce1b.exe netsh.exe PID 2000 wrote to memory of 2856 2000 24252e6b573e398f3161fb58bdccce1b.exe mfbfgo.exe PID 2000 wrote to memory of 2856 2000 24252e6b573e398f3161fb58bdccce1b.exe mfbfgo.exe PID 2000 wrote to memory of 2856 2000 24252e6b573e398f3161fb58bdccce1b.exe mfbfgo.exe PID 2000 wrote to memory of 2856 2000 24252e6b573e398f3161fb58bdccce1b.exe mfbfgo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"C:\Users\Admin\AppData\Local\Temp\24252e6b573e398f3161fb58bdccce1b.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\mfbfgo.exe"C:\Users\Admin\AppData\Local\mfbfgo.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\mfbfgo.exe"C:\Users\Admin\AppData\Local\mfbfgo.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-6-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-14-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-2-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-4-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-27-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-15-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-12-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2000-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2000-8-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-49-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-53-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-62-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-61-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-60-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-48-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-50-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-51-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-52-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-59-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-54-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-55-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-56-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-57-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2744-58-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2856-28-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/2856-29-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/3044-0-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/3044-1-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB