Analysis
-
max time kernel
167s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
4a585ee0c216369f0392abd7b7ef0c1c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a585ee0c216369f0392abd7b7ef0c1c.exe
Resource
win10v2004-20231215-en
General
-
Target
4a585ee0c216369f0392abd7b7ef0c1c.exe
-
Size
11.4MB
-
MD5
4a585ee0c216369f0392abd7b7ef0c1c
-
SHA1
ecd87636940b7b7b650bae8c43f4d7afbcb291ec
-
SHA256
3fb717331c0f4b48744117e7844a4bcf08333af621cfcfe790d4a5e2dcf810fe
-
SHA512
8beae9f3b75758469f155b9b8a91d030e3282ab7414edc6ec47572aae5c87e944aec40cb627abc3d0c1c4f7c0730f32d02f1ec7e5511aa4dfc4b610b14a2b5c7
-
SSDEEP
24576:OjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeW:O/D
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1684 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\znwhtfuy\ImagePath = "C:\\Windows\\SysWOW64\\znwhtfuy\\xkbkcprl.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 4a585ee0c216369f0392abd7b7ef0c1c.exe -
Executes dropped EXE 1 IoCs
pid Process 3876 xkbkcprl.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3876 set thread context of 3420 3876 xkbkcprl.exe 108 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1564 sc.exe 2820 sc.exe 2316 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4488 wrote to memory of 440 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 93 PID 4488 wrote to memory of 440 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 93 PID 4488 wrote to memory of 440 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 93 PID 4488 wrote to memory of 392 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 95 PID 4488 wrote to memory of 392 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 95 PID 4488 wrote to memory of 392 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 95 PID 4488 wrote to memory of 1564 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 97 PID 4488 wrote to memory of 1564 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 97 PID 4488 wrote to memory of 1564 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 97 PID 4488 wrote to memory of 2820 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 99 PID 4488 wrote to memory of 2820 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 99 PID 4488 wrote to memory of 2820 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 99 PID 4488 wrote to memory of 2316 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 101 PID 4488 wrote to memory of 2316 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 101 PID 4488 wrote to memory of 2316 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 101 PID 4488 wrote to memory of 1684 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 103 PID 4488 wrote to memory of 1684 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 103 PID 4488 wrote to memory of 1684 4488 4a585ee0c216369f0392abd7b7ef0c1c.exe 103 PID 3876 wrote to memory of 3420 3876 xkbkcprl.exe 108 PID 3876 wrote to memory of 3420 3876 xkbkcprl.exe 108 PID 3876 wrote to memory of 3420 3876 xkbkcprl.exe 108 PID 3876 wrote to memory of 3420 3876 xkbkcprl.exe 108 PID 3876 wrote to memory of 3420 3876 xkbkcprl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a585ee0c216369f0392abd7b7ef0c1c.exe"C:\Users\Admin\AppData\Local\Temp\4a585ee0c216369f0392abd7b7ef0c1c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\znwhtfuy\2⤵PID:440
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xkbkcprl.exe" C:\Windows\SysWOW64\znwhtfuy\2⤵PID:392
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create znwhtfuy binPath= "C:\Windows\SysWOW64\znwhtfuy\xkbkcprl.exe /d\"C:\Users\Admin\AppData\Local\Temp\4a585ee0c216369f0392abd7b7ef0c1c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1564
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description znwhtfuy "wifi internet conection"2⤵
- Launches sc.exe
PID:2820
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start znwhtfuy2⤵
- Launches sc.exe
PID:2316
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1684
-
-
C:\Windows\SysWOW64\znwhtfuy\xkbkcprl.exeC:\Windows\SysWOW64\znwhtfuy\xkbkcprl.exe /d"C:\Users\Admin\AppData\Local\Temp\4a585ee0c216369f0392abd7b7ef0c1c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
PID:3420
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD5700f7fe960dd994622134ecb5039dd15
SHA14b0fe978100a417553749953f694554ac09cbd0c
SHA25690c1ddcb3aa01d5c896f263022a197d9cce01a41688c32352585702bdddcd602
SHA5120aad6304fabf1eed1576f97b69406829fe0805aeff9932b6b9902a51d119793f64cd80c408f72a457a6e3b0f1ca1f6ab9ba024913ed04882491113dd8c298f84