Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 05:19
Static task
static1
Behavioral task
behavioral1
Sample
c512b0dccb9f92204e6fb655c6b51333.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c512b0dccb9f92204e6fb655c6b51333.exe
Resource
win10v2004-20240226-en
General
-
Target
c512b0dccb9f92204e6fb655c6b51333.exe
-
Size
10.1MB
-
MD5
c512b0dccb9f92204e6fb655c6b51333
-
SHA1
dd085d130c33c357e829863630a4377be11c76da
-
SHA256
c78d053710f55ecd76867851e5ef0a5fc387ff22e146aeeb6055b928a74322e1
-
SHA512
c3c55b079d61a5efa9f3c3960763063024a4d7a500a9ffbd8bd8273e78de42f836d4e86b9d1ce8c8e1031c001e9905b7b49ef614420f55d1d8c810969a79f351
-
SSDEEP
12288:nljL7ioRGJyDJSuiAZzlsO+++++++++++++++++++++++++++++++++++++++++W:p7hR5QAZi
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4172 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cryrgrir\ImagePath = "C:\\Windows\\SysWOW64\\cryrgrir\\obxnvcxh.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation c512b0dccb9f92204e6fb655c6b51333.exe -
Deletes itself 1 IoCs
pid Process 1276 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1300 obxnvcxh.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1300 set thread context of 1276 1300 obxnvcxh.exe 105 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2132 sc.exe 1636 sc.exe 1932 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 420 wrote to memory of 2408 420 c512b0dccb9f92204e6fb655c6b51333.exe 92 PID 420 wrote to memory of 2408 420 c512b0dccb9f92204e6fb655c6b51333.exe 92 PID 420 wrote to memory of 2408 420 c512b0dccb9f92204e6fb655c6b51333.exe 92 PID 420 wrote to memory of 1936 420 c512b0dccb9f92204e6fb655c6b51333.exe 94 PID 420 wrote to memory of 1936 420 c512b0dccb9f92204e6fb655c6b51333.exe 94 PID 420 wrote to memory of 1936 420 c512b0dccb9f92204e6fb655c6b51333.exe 94 PID 420 wrote to memory of 1636 420 c512b0dccb9f92204e6fb655c6b51333.exe 96 PID 420 wrote to memory of 1636 420 c512b0dccb9f92204e6fb655c6b51333.exe 96 PID 420 wrote to memory of 1636 420 c512b0dccb9f92204e6fb655c6b51333.exe 96 PID 420 wrote to memory of 1932 420 c512b0dccb9f92204e6fb655c6b51333.exe 98 PID 420 wrote to memory of 1932 420 c512b0dccb9f92204e6fb655c6b51333.exe 98 PID 420 wrote to memory of 1932 420 c512b0dccb9f92204e6fb655c6b51333.exe 98 PID 420 wrote to memory of 2132 420 c512b0dccb9f92204e6fb655c6b51333.exe 100 PID 420 wrote to memory of 2132 420 c512b0dccb9f92204e6fb655c6b51333.exe 100 PID 420 wrote to memory of 2132 420 c512b0dccb9f92204e6fb655c6b51333.exe 100 PID 420 wrote to memory of 4172 420 c512b0dccb9f92204e6fb655c6b51333.exe 103 PID 420 wrote to memory of 4172 420 c512b0dccb9f92204e6fb655c6b51333.exe 103 PID 420 wrote to memory of 4172 420 c512b0dccb9f92204e6fb655c6b51333.exe 103 PID 1300 wrote to memory of 1276 1300 obxnvcxh.exe 105 PID 1300 wrote to memory of 1276 1300 obxnvcxh.exe 105 PID 1300 wrote to memory of 1276 1300 obxnvcxh.exe 105 PID 1300 wrote to memory of 1276 1300 obxnvcxh.exe 105 PID 1300 wrote to memory of 1276 1300 obxnvcxh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c512b0dccb9f92204e6fb655c6b51333.exe"C:\Users\Admin\AppData\Local\Temp\c512b0dccb9f92204e6fb655c6b51333.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cryrgrir\2⤵PID:2408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\obxnvcxh.exe" C:\Windows\SysWOW64\cryrgrir\2⤵PID:1936
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cryrgrir binPath= "C:\Windows\SysWOW64\cryrgrir\obxnvcxh.exe /d\"C:\Users\Admin\AppData\Local\Temp\c512b0dccb9f92204e6fb655c6b51333.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1636
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cryrgrir "wifi internet conection"2⤵
- Launches sc.exe
PID:1932
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cryrgrir2⤵
- Launches sc.exe
PID:2132
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4172
-
-
C:\Windows\SysWOW64\cryrgrir\obxnvcxh.exeC:\Windows\SysWOW64\cryrgrir\obxnvcxh.exe /d"C:\Users\Admin\AppData\Local\Temp\c512b0dccb9f92204e6fb655c6b51333.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:1276
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD53ff06adc89f3447e84281b00d462afc3
SHA1e01af46570c511db04ecd7336a33a7c385add6df
SHA256cdf77ec387a3a35b20f7ff29083642a3a7c19e65b1ceaae0f5882bd0a820bad8
SHA512523d6e51c541ca6a477c96f00a501b540799c6b71cc1e9f25af9b52d9b84f4ee8b59bd392637897ecccb2e431aab00b4d7d13d548afdaa5892dfbf1ad617b052
-
Filesize
50KB
MD5dc4a27d88d299b8f3697e05ea761b5a7
SHA174e4c44097daddfe7a463b7b4a9971726409aef5
SHA25654370381b87d44e483cb3528ac48c89731a050e8212328003e8b77c1e84de4a2
SHA5125f9d40f9d34c252afca10256427330c94038eaf67b9cebbf8d6d52e704dd8a7f1e2b7c837307182b963c7a46d05a5143c6284e5ca9941753057ece6a6d17c965