Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2024 11:04
Static task
static1
Behavioral task
behavioral1
Sample
91d38ff34f7873e73bcc3860dcfebb61.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
91d38ff34f7873e73bcc3860dcfebb61.exe
Resource
win10v2004-20231215-en
General
-
Target
91d38ff34f7873e73bcc3860dcfebb61.exe
-
Size
147KB
-
MD5
91d38ff34f7873e73bcc3860dcfebb61
-
SHA1
89708ae9a87da9547e5b107ed444d457b2c753eb
-
SHA256
6fd9798ecac7cdfd94e55a36b9be488f9f52db44cd012ebbf2b718c8ffa5ff44
-
SHA512
ef004be03571d0e17afc3c785adb75fe974a59010e271307e9252cf2436a0118ee9c0fff7b24a5512d31e7f54c69ed562414484e90c78cf196cb5ac78fc8fea4
-
SSDEEP
3072:Yid3OHRBIRVcJ3Yeq4lExI7clo8gSyn+9C:7BOIYGe5lkovuC
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2996 netsh.exe -
Drops startup file 4 IoCs
Processes:
ibmvfe.exe91d38ff34f7873e73bcc3860dcfebb61.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\godos.exe ibmvfe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\godos.exe ibmvfe.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\godos.exe 91d38ff34f7873e73bcc3860dcfebb61.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\godos.exe 91d38ff34f7873e73bcc3860dcfebb61.exe -
Executes dropped EXE 2 IoCs
Processes:
ibmvfe.exeibmvfe.exepid process 1940 ibmvfe.exe 1620 ibmvfe.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exeibmvfe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jmbfwudq = "C:\\Users\\Admin\\AppData\\Local\\ibmvfe.exe" 91d38ff34f7873e73bcc3860dcfebb61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jmbfwudq = "C:\\Users\\Admin\\AppData\\Local\\ibmvfe.exe" 91d38ff34f7873e73bcc3860dcfebb61.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jmbfwudq = "C:\\Users\\Admin\\AppData\\Local\\ibmvfe.exe" ibmvfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jmbfwudq = "C:\\Users\\Admin\\AppData\\Local\\ibmvfe.exe" ibmvfe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exeibmvfe.exedescription pid process target process PID 3348 set thread context of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 1940 set thread context of 1620 1940 ibmvfe.exe ibmvfe.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
91d38ff34f7873e73bcc3860dcfebb61.exe91d38ff34f7873e73bcc3860dcfebb61.exeibmvfe.exedescription pid process target process PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 3348 wrote to memory of 4448 3348 91d38ff34f7873e73bcc3860dcfebb61.exe 91d38ff34f7873e73bcc3860dcfebb61.exe PID 4448 wrote to memory of 2996 4448 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 4448 wrote to memory of 2996 4448 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 4448 wrote to memory of 2996 4448 91d38ff34f7873e73bcc3860dcfebb61.exe netsh.exe PID 4448 wrote to memory of 1940 4448 91d38ff34f7873e73bcc3860dcfebb61.exe ibmvfe.exe PID 4448 wrote to memory of 1940 4448 91d38ff34f7873e73bcc3860dcfebb61.exe ibmvfe.exe PID 4448 wrote to memory of 1940 4448 91d38ff34f7873e73bcc3860dcfebb61.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe PID 1940 wrote to memory of 1620 1940 ibmvfe.exe ibmvfe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe"C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exeC:\Users\Admin\AppData\Local\Temp\91d38ff34f7873e73bcc3860dcfebb61.exe2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\ibmvfe.exe"C:\Users\Admin\AppData\Local\ibmvfe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ibmvfe.exeC:\Users\Admin\AppData\Local\ibmvfe.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ibmvfe.exeFilesize
147KB
MD591d38ff34f7873e73bcc3860dcfebb61
SHA189708ae9a87da9547e5b107ed444d457b2c753eb
SHA2566fd9798ecac7cdfd94e55a36b9be488f9f52db44cd012ebbf2b718c8ffa5ff44
SHA512ef004be03571d0e17afc3c785adb75fe974a59010e271307e9252cf2436a0118ee9c0fff7b24a5512d31e7f54c69ed562414484e90c78cf196cb5ac78fc8fea4
-
memory/1620-68-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-75-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-76-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-59-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-63-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-61-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-74-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-73-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-72-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-71-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-70-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-62-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-66-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-67-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-65-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1620-69-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1940-50-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-47-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-46-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-52-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-44-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-55-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1940-64-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/3348-15-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-13-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-8-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-10-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-22-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-20-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-17-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3348-9-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/4448-21-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4448-56-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4448-25-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4448-24-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB