78282415f8674fadd97290ee833d500a8cd5cecaab9855c9c6dcc4b169459faa

General

Target

bc9430ddbf4b86ee152a6776c38fb1ad.exe
Size

311KB
MD5

bc9430ddbf4b86ee152a6776c38fb1ad
SHA1

cac02947fa5cdfcd09453114604ac31d3b8ef1b2
SHA256

78282415f8674fadd97290ee833d500a8cd5cecaab9855c9c6dcc4b169459faa
SHA512

f36aa22d434c95a5dfe44414bac0ae6ee2083c0ed09f42308c0c81c4e52b5ee0115b31d6a4510b7867f0857a761c3de2a33b279e14abfb5df8a46927ac4e6189
SSDEEP

6144:ksbBiWhz9/wAS64Aq4uGp2hpEwdI41gY9sF:ksBrtVSz+uu6NI1

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

oxfal.exe

pid process

2312 oxfal.exe
Loads dropped DLL 2 IoCs

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exe

pid process

2208 bc9430ddbf4b86ee152a6776c38fb1ad.exe
2208 bc9430ddbf4b86ee152a6776c38fb1ad.exe

pid	process
2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe
2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oxfal.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\{8AB77948-8466-AD4E-E8B6-6988D6F14A95} = "C:\\Users\\Admin\\AppData\\Roaming\\Nexaq\\oxfal.exe"	oxfal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exe

description pid process target process

PID 2208 set thread context of 2880 2208 bc9430ddbf4b86ee152a6776c38fb1ad.exe cmd.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

480 2880 WerFault.exe cmd.exe

description	pid	process	target process
PID 2208 set thread context of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe

pid	pid_target	process	target process
480	2880	WerFault.exe	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Privacy	bc9430ddbf4b86ee152a6776c38fb1ad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	bc9430ddbf4b86ee152a6776c38fb1ad.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

oxfal.exe

pid	process
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe
2312	oxfal.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exe

description	pid	process
Token: SeSecurityPrivilege	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe
Token: SeSecurityPrivilege	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe
Token: SeSecurityPrivilege	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exeoxfal.exe

pid process

2208 bc9430ddbf4b86ee152a6776c38fb1ad.exe
2312 oxfal.exe

pid	process
2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe
2312	oxfal.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

bc9430ddbf4b86ee152a6776c38fb1ad.exeoxfal.execmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 2312	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	oxfal.exe
PID 2208 wrote to memory of 2312	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	oxfal.exe
PID 2208 wrote to memory of 2312	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	oxfal.exe
PID 2208 wrote to memory of 2312	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	oxfal.exe
PID 2312 wrote to memory of 1080	2312	oxfal.exe	taskhost.exe
PID 2312 wrote to memory of 1080	2312	oxfal.exe	taskhost.exe
PID 2312 wrote to memory of 1080	2312	oxfal.exe	taskhost.exe
PID 2312 wrote to memory of 1080	2312	oxfal.exe	taskhost.exe
PID 2312 wrote to memory of 1080	2312	oxfal.exe	taskhost.exe
PID 2312 wrote to memory of 1144	2312	oxfal.exe	Dwm.exe
PID 2312 wrote to memory of 1144	2312	oxfal.exe	Dwm.exe
PID 2312 wrote to memory of 1144	2312	oxfal.exe	Dwm.exe
PID 2312 wrote to memory of 1144	2312	oxfal.exe	Dwm.exe
PID 2312 wrote to memory of 1144	2312	oxfal.exe	Dwm.exe
PID 2312 wrote to memory of 1176	2312	oxfal.exe	Explorer.EXE
PID 2312 wrote to memory of 1176	2312	oxfal.exe	Explorer.EXE
PID 2312 wrote to memory of 1176	2312	oxfal.exe	Explorer.EXE
PID 2312 wrote to memory of 1176	2312	oxfal.exe	Explorer.EXE
PID 2312 wrote to memory of 1176	2312	oxfal.exe	Explorer.EXE
PID 2312 wrote to memory of 1852	2312	oxfal.exe	DllHost.exe
PID 2312 wrote to memory of 1852	2312	oxfal.exe	DllHost.exe
PID 2312 wrote to memory of 1852	2312	oxfal.exe	DllHost.exe
PID 2312 wrote to memory of 1852	2312	oxfal.exe	DllHost.exe
PID 2312 wrote to memory of 1852	2312	oxfal.exe	DllHost.exe
PID 2312 wrote to memory of 2208	2312	oxfal.exe	bc9430ddbf4b86ee152a6776c38fb1ad.exe
PID 2312 wrote to memory of 2208	2312	oxfal.exe	bc9430ddbf4b86ee152a6776c38fb1ad.exe
PID 2312 wrote to memory of 2208	2312	oxfal.exe	bc9430ddbf4b86ee152a6776c38fb1ad.exe
PID 2312 wrote to memory of 2208	2312	oxfal.exe	bc9430ddbf4b86ee152a6776c38fb1ad.exe
PID 2312 wrote to memory of 2208	2312	oxfal.exe	bc9430ddbf4b86ee152a6776c38fb1ad.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2208 wrote to memory of 2880	2208	bc9430ddbf4b86ee152a6776c38fb1ad.exe	cmd.exe
PID 2880 wrote to memory of 480	2880	cmd.exe	WerFault.exe
PID 2880 wrote to memory of 480	2880	cmd.exe	WerFault.exe
PID 2880 wrote to memory of 480	2880	cmd.exe	WerFault.exe
PID 2880 wrote to memory of 480	2880	cmd.exe	WerFault.exe
PID 2312 wrote to memory of 1508	2312	oxfal.exe	conhost.exe
PID 2312 wrote to memory of 1508	2312	oxfal.exe	conhost.exe
PID 2312 wrote to memory of 1508	2312	oxfal.exe	conhost.exe
PID 2312 wrote to memory of 1508	2312	oxfal.exe	conhost.exe
PID 2312 wrote to memory of 1508	2312	oxfal.exe	conhost.exe
PID 2312 wrote to memory of 480	2312	oxfal.exe	WerFault.exe
PID 2312 wrote to memory of 480	2312	oxfal.exe	WerFault.exe
PID 2312 wrote to memory of 480	2312	oxfal.exe	WerFault.exe
PID 2312 wrote to memory of 480	2312	oxfal.exe	WerFault.exe
PID 2312 wrote to memory of 480	2312	oxfal.exe	WerFault.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1080

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1144

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176

C:\Users\Admin\AppData\Local\Temp\bc9430ddbf4b86ee152a6776c38fb1ad.exe
"C:\Users\Admin\AppData\Local\Temp\bc9430ddbf4b86ee152a6776c38fb1ad.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Roaming\Nexaq\oxfal.exe
"C:\Users\Admin\AppData\Roaming\Nexaq\oxfal.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp07437f5b.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 116
4⤵
- Program crash
PID:480

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-429556646-394822863-112639150625216462816279033216963944049575954861981486158"
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Lafee\ujuzz.goe
Filesize
366B

MD5
ce6f93a1b7c778ad2dba997b67737233

SHA1
05d3d881ed3bec5b6eb80920644bb3c6b007a2ef

SHA256
b9c46358d720d11580fc7b10fcb890fa8573bddb4c8dc1a26ee6a80d488a9ef7

SHA512
5ba439c26630fc7593f056d6c6cad6654ceb2073487890dcef5ba99a6461ca985527e0422cbb5e612408343f67212aaff52028adc6220afa8d3d3c1c69efc1b6

Download Submit
\Users\Admin\AppData\Roaming\Nexaq\oxfal.exe
Filesize
311KB

MD5
577d44dd450663b980230613ab40c05d

SHA1
cf01a4f296e2f1780542d09750e2b25465289dac

SHA256
9e3d9a4cec2e9e20f7b27bb78d70469bcb10c3f44be4f7cbe333bff3e8816c99

SHA512
4641b49cc98a9cfba9ef85f84f38388ee636e8bc5142f9325de6bc9aa13acd5f0da9f3ef6406b1db2c7ec3854d7d8188c8c8450e469856b831d99a56916fcaba

Download Submit
memory/480-282-0x0000000002220000-0x0000000002261000-memory.dmp

Filesize
260KB

Download
memory/480-279-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/480-203-0x0000000077650000-0x0000000077651000-memory.dmp

Filesize
4KB

Download
memory/480-181-0x0000000002220000-0x0000000002261000-memory.dmp

Filesize
260KB

Download
memory/1080-19-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download
memory/1080-21-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download
memory/1080-23-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download
memory/1080-25-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download
memory/1080-27-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download
memory/1144-30-0x0000000000120000-0x0000000000161000-memory.dmp

Filesize
260KB

Download
memory/1144-32-0x0000000000120000-0x0000000000161000-memory.dmp

Filesize
260KB

Download
memory/1144-33-0x0000000000120000-0x0000000000161000-memory.dmp

Filesize
260KB

Download
memory/1144-31-0x0000000000120000-0x0000000000161000-memory.dmp

Filesize
260KB

Download
memory/1176-35-0x00000000029F0000-0x0000000002A31000-memory.dmp

Filesize
260KB

Download
memory/1176-37-0x00000000029F0000-0x0000000002A31000-memory.dmp

Filesize
260KB

Download
memory/1176-36-0x00000000029F0000-0x0000000002A31000-memory.dmp

Filesize
260KB

Download
memory/1176-38-0x00000000029F0000-0x0000000002A31000-memory.dmp

Filesize
260KB

Download
memory/1852-40-0x0000000001D90000-0x0000000001DD1000-memory.dmp

Filesize
260KB

Download
memory/1852-41-0x0000000001D90000-0x0000000001DD1000-memory.dmp

Filesize
260KB

Download
memory/1852-42-0x0000000001D90000-0x0000000001DD1000-memory.dmp

Filesize
260KB

Download
memory/1852-43-0x0000000001D90000-0x0000000001DD1000-memory.dmp

Filesize
260KB

Download
memory/2208-71-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-59-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-48-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-53-0x0000000077650000-0x0000000077651000-memory.dmp

Filesize
4KB

Download
memory/2208-54-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-49-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-69-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-67-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-83-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-81-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-79-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-77-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-75-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-73-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-65-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-63-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-61-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-50-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-57-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-55-0x0000000077650000-0x0000000077651000-memory.dmp

Filesize
4KB

Download
memory/2208-51-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-47-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-46-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-45-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-145-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2208-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2208-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2208-169-0x0000000000490000-0x00000000004D1000-memory.dmp

Filesize
260KB

Download
memory/2208-1-0x0000000000390000-0x00000000003E1000-memory.dmp

Filesize
324KB

Download
memory/2208-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2208-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2208-0-0x0000000000270000-0x00000000002B1000-memory.dmp

Filesize
260KB

Download
memory/2312-17-0x00000000002D0000-0x0000000000321000-memory.dmp

Filesize
324KB

Download
memory/2312-18-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2312-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2312-16-0x0000000000270000-0x00000000002B1000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads