Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
c562dc58e71fd79abd570506dfa5f123.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c562dc58e71fd79abd570506dfa5f123.exe
Resource
win10v2004-20240226-en
General
-
Target
c562dc58e71fd79abd570506dfa5f123.exe
-
Size
10.2MB
-
MD5
c562dc58e71fd79abd570506dfa5f123
-
SHA1
493df28d868ae1b809620c8e5b25d934b9e639f0
-
SHA256
341c5f516b4e4557f25b162811efabca0135d390c00b061dce9f82608afe04cf
-
SHA512
65884b9c366cb07f9244eaa697194d911e486a709dbbe40ab042af6240d979405fceca905e145e75dd266655f32c9fa8995bf22e32a27e461c4c125e0e073442
-
SSDEEP
49152:w1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllln:wA
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\clgupcoz = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3028 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\clgupcoz\ImagePath = "C:\\Windows\\SysWOW64\\clgupcoz\\mlzbpmnf.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2464 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2476 mlzbpmnf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2476 set thread context of 2464 2476 mlzbpmnf.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2912 sc.exe 2728 sc.exe 2556 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2640 2160 c562dc58e71fd79abd570506dfa5f123.exe 28 PID 2160 wrote to memory of 2640 2160 c562dc58e71fd79abd570506dfa5f123.exe 28 PID 2160 wrote to memory of 2640 2160 c562dc58e71fd79abd570506dfa5f123.exe 28 PID 2160 wrote to memory of 2640 2160 c562dc58e71fd79abd570506dfa5f123.exe 28 PID 2160 wrote to memory of 2676 2160 c562dc58e71fd79abd570506dfa5f123.exe 30 PID 2160 wrote to memory of 2676 2160 c562dc58e71fd79abd570506dfa5f123.exe 30 PID 2160 wrote to memory of 2676 2160 c562dc58e71fd79abd570506dfa5f123.exe 30 PID 2160 wrote to memory of 2676 2160 c562dc58e71fd79abd570506dfa5f123.exe 30 PID 2160 wrote to memory of 2556 2160 c562dc58e71fd79abd570506dfa5f123.exe 32 PID 2160 wrote to memory of 2556 2160 c562dc58e71fd79abd570506dfa5f123.exe 32 PID 2160 wrote to memory of 2556 2160 c562dc58e71fd79abd570506dfa5f123.exe 32 PID 2160 wrote to memory of 2556 2160 c562dc58e71fd79abd570506dfa5f123.exe 32 PID 2160 wrote to memory of 2912 2160 c562dc58e71fd79abd570506dfa5f123.exe 34 PID 2160 wrote to memory of 2912 2160 c562dc58e71fd79abd570506dfa5f123.exe 34 PID 2160 wrote to memory of 2912 2160 c562dc58e71fd79abd570506dfa5f123.exe 34 PID 2160 wrote to memory of 2912 2160 c562dc58e71fd79abd570506dfa5f123.exe 34 PID 2160 wrote to memory of 2728 2160 c562dc58e71fd79abd570506dfa5f123.exe 36 PID 2160 wrote to memory of 2728 2160 c562dc58e71fd79abd570506dfa5f123.exe 36 PID 2160 wrote to memory of 2728 2160 c562dc58e71fd79abd570506dfa5f123.exe 36 PID 2160 wrote to memory of 2728 2160 c562dc58e71fd79abd570506dfa5f123.exe 36 PID 2160 wrote to memory of 3028 2160 c562dc58e71fd79abd570506dfa5f123.exe 39 PID 2160 wrote to memory of 3028 2160 c562dc58e71fd79abd570506dfa5f123.exe 39 PID 2160 wrote to memory of 3028 2160 c562dc58e71fd79abd570506dfa5f123.exe 39 PID 2160 wrote to memory of 3028 2160 c562dc58e71fd79abd570506dfa5f123.exe 39 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41 PID 2476 wrote to memory of 2464 2476 mlzbpmnf.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\c562dc58e71fd79abd570506dfa5f123.exe"C:\Users\Admin\AppData\Local\Temp\c562dc58e71fd79abd570506dfa5f123.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\clgupcoz\2⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mlzbpmnf.exe" C:\Windows\SysWOW64\clgupcoz\2⤵PID:2676
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create clgupcoz binPath= "C:\Windows\SysWOW64\clgupcoz\mlzbpmnf.exe /d\"C:\Users\Admin\AppData\Local\Temp\c562dc58e71fd79abd570506dfa5f123.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2556
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description clgupcoz "wifi internet conection"2⤵
- Launches sc.exe
PID:2912
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start clgupcoz2⤵
- Launches sc.exe
PID:2728
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:3028
-
-
C:\Windows\SysWOW64\clgupcoz\mlzbpmnf.exeC:\Windows\SysWOW64\clgupcoz\mlzbpmnf.exe /d"C:\Users\Admin\AppData\Local\Temp\c562dc58e71fd79abd570506dfa5f123.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.7MB
MD5772fc4ee05deadfbbf583be13de30678
SHA19aed6d8ab4f19bdead0a2d7553bff287593068ce
SHA256f20383f68b4972d0579a715c91e8c7c1bf8b3847e52a55854bac5fb04b2fdbdd
SHA5128328661ca8d0658535a59b28269c192af3e1b30cae6b4dcf2ba2bff3087083bd9f38fe43299c66be489db09e7a0b27c3bd81a9713b5100177a65670e3356dee4
-
Filesize
3.6MB
MD576d525211c83d1608d094f22fb7c75b9
SHA1169c498a04294a0bda8dd4912c0edc939decee99
SHA256e41a8bdbde37b3bb5c84d1286e16156399c27c9246a57938a00c64da72f3314f
SHA5126f8360d9c75017b46ce16659b9b6ff2541cff402f11ee43f2ee64fcffccea545284489c8fc80daf3e5e054c3d7208f398cba32afa1bb5fa1f56143e0de5295bd