Analysis

  • max time kernel
    1s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:36

General

  • Target

    a4ca303e0a9292f78b545bf698aa8c33.exe

  • Size

    14.9MB

  • MD5

    a4ca303e0a9292f78b545bf698aa8c33

  • SHA1

    5ce9ca6dc27363590c336557bba58370c3659a14

  • SHA256

    3e1682d2d6974e4284db9c5453e9bf08cab44d73cbb60682d2b9bcbcab9c75c3

  • SHA512

    282b4956e81d56da3572b011aa486f6492efbb6c673bd7bd2c5803111cea4cbea3db7ff2a12d86c3134a81e4c30117eedfe6b9829c9d58b32b9a6af96bc386c5

  • SSDEEP

    24576:7jDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBt:7nh

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4ca303e0a9292f78b545bf698aa8c33.exe
    "C:\Users\Admin\AppData\Local\Temp\a4ca303e0a9292f78b545bf698aa8c33.exe"
    1⤵
      PID:3900
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vrsrbemn\
        2⤵
          PID:3372
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jwnwobdx.exe" C:\Windows\SysWOW64\vrsrbemn\
          2⤵
            PID:2476
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create vrsrbemn binPath= "C:\Windows\SysWOW64\vrsrbemn\jwnwobdx.exe /d\"C:\Users\Admin\AppData\Local\Temp\a4ca303e0a9292f78b545bf698aa8c33.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
            • Launches sc.exe
            PID:2320
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description vrsrbemn "wifi internet conection"
            2⤵
            • Launches sc.exe
            PID:4808
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" start vrsrbemn
            2⤵
            • Launches sc.exe
            PID:3472
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
            2⤵
            • Modifies Windows Firewall
            PID:3408
        • C:\Windows\SysWOW64\vrsrbemn\jwnwobdx.exe
          C:\Windows\SysWOW64\vrsrbemn\jwnwobdx.exe /d"C:\Users\Admin\AppData\Local\Temp\a4ca303e0a9292f78b545bf698aa8c33.exe"
          1⤵
            PID:1280
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              2⤵
                PID:4340

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1280-8-0x0000000000740000-0x0000000000840000-memory.dmp

                    Filesize

                    1024KB

                  • memory/1280-10-0x0000000000400000-0x000000000046E000-memory.dmp

                    Filesize

                    440KB

                  • memory/3900-22-0x0000000000640000-0x0000000000740000-memory.dmp

                    Filesize

                    1024KB

                  • memory/3900-4-0x0000000000400000-0x000000000046E000-memory.dmp

                    Filesize

                    440KB

                  • memory/3900-1-0x0000000000640000-0x0000000000740000-memory.dmp

                    Filesize

                    1024KB

                  • memory/3900-23-0x0000000000610000-0x0000000000623000-memory.dmp

                    Filesize

                    76KB

                  • memory/3900-2-0x0000000000610000-0x0000000000623000-memory.dmp

                    Filesize

                    76KB

                  • memory/3900-14-0x0000000000400000-0x000000000046E000-memory.dmp

                    Filesize

                    440KB

                  • memory/4340-13-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

                    Filesize

                    84KB

                  • memory/4340-16-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

                    Filesize

                    84KB

                  • memory/4340-15-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

                    Filesize

                    84KB

                  • memory/4340-9-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

                    Filesize

                    84KB

                  • memory/4340-26-0x0000000000BE0000-0x0000000000BF5000-memory.dmp

                    Filesize

                    84KB