Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
c589e57813712cdca2f4e39ab028c665.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c589e57813712cdca2f4e39ab028c665.exe
Resource
win10v2004-20240226-en
General
-
Target
c589e57813712cdca2f4e39ab028c665.exe
-
Size
12.6MB
-
MD5
c589e57813712cdca2f4e39ab028c665
-
SHA1
8fdaac9837d59ae86e15ea0ce17afb5b1ddbf447
-
SHA256
7c74a5c28e75dc5c494548b2f305d0bd34ac51c4fbe72e32a24df04397fb4cbd
-
SHA512
2d582894b12996acdff1560a032fc2ee34d313be92eec23ec2517ef9af9da07b45bbaf8e4dd0817eb0c13947e8141ad45fcfe6f83bdec5bf859503e3d04268da
-
SSDEEP
49152:vj55555555555555555555555555555555555555555555555555555555555553:
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2296 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hrenqitv\ImagePath = "C:\\Windows\\SysWOW64\\hrenqitv\\xwiejtdq.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation c589e57813712cdca2f4e39ab028c665.exe -
Deletes itself 1 IoCs
pid Process 4492 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3720 xwiejtdq.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3720 set thread context of 4492 3720 xwiejtdq.exe 102 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2092 sc.exe 2748 sc.exe 2988 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 836 wrote to memory of 3992 836 c589e57813712cdca2f4e39ab028c665.exe 88 PID 836 wrote to memory of 3992 836 c589e57813712cdca2f4e39ab028c665.exe 88 PID 836 wrote to memory of 3992 836 c589e57813712cdca2f4e39ab028c665.exe 88 PID 836 wrote to memory of 4128 836 c589e57813712cdca2f4e39ab028c665.exe 92 PID 836 wrote to memory of 4128 836 c589e57813712cdca2f4e39ab028c665.exe 92 PID 836 wrote to memory of 4128 836 c589e57813712cdca2f4e39ab028c665.exe 92 PID 836 wrote to memory of 2092 836 c589e57813712cdca2f4e39ab028c665.exe 94 PID 836 wrote to memory of 2092 836 c589e57813712cdca2f4e39ab028c665.exe 94 PID 836 wrote to memory of 2092 836 c589e57813712cdca2f4e39ab028c665.exe 94 PID 836 wrote to memory of 2748 836 c589e57813712cdca2f4e39ab028c665.exe 97 PID 836 wrote to memory of 2748 836 c589e57813712cdca2f4e39ab028c665.exe 97 PID 836 wrote to memory of 2748 836 c589e57813712cdca2f4e39ab028c665.exe 97 PID 836 wrote to memory of 2988 836 c589e57813712cdca2f4e39ab028c665.exe 99 PID 836 wrote to memory of 2988 836 c589e57813712cdca2f4e39ab028c665.exe 99 PID 836 wrote to memory of 2988 836 c589e57813712cdca2f4e39ab028c665.exe 99 PID 3720 wrote to memory of 4492 3720 xwiejtdq.exe 102 PID 3720 wrote to memory of 4492 3720 xwiejtdq.exe 102 PID 3720 wrote to memory of 4492 3720 xwiejtdq.exe 102 PID 3720 wrote to memory of 4492 3720 xwiejtdq.exe 102 PID 3720 wrote to memory of 4492 3720 xwiejtdq.exe 102 PID 836 wrote to memory of 2296 836 c589e57813712cdca2f4e39ab028c665.exe 103 PID 836 wrote to memory of 2296 836 c589e57813712cdca2f4e39ab028c665.exe 103 PID 836 wrote to memory of 2296 836 c589e57813712cdca2f4e39ab028c665.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hrenqitv\2⤵PID:3992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xwiejtdq.exe" C:\Windows\SysWOW64\hrenqitv\2⤵PID:4128
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hrenqitv binPath= "C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe /d\"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2092
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hrenqitv "wifi internet conection"2⤵
- Launches sc.exe
PID:2748
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hrenqitv2⤵
- Launches sc.exe
PID:2988
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2296
-
-
C:\Windows\SysWOW64\hrenqitv\xwiejtdq.exeC:\Windows\SysWOW64\hrenqitv\xwiejtdq.exe /d"C:\Users\Admin\AppData\Local\Temp\c589e57813712cdca2f4e39ab028c665.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:4492
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.8MB
MD5103fa56bbbf7f69b1f554acb22b00a56
SHA1ba9968ad9178a12fcc8233a36b9dc3b28b4ff38a
SHA25672afe1dce02f63aff5116011cd9f3d3123dee9aef3d870f84e0acb187fef8de4
SHA5126ddcf83dda09e0358097261a81a94f1460a2b3b914ea2d43ee688e1dc16e3e1686b18fef4a8b025054934af093af062734bda2a9dab3cbd5acdb1f6dcc55418f