Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
c5b025bdaf3514eec1039bdfd3136719.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c5b025bdaf3514eec1039bdfd3136719.exe
Resource
win10v2004-20240226-en
General
-
Target
c5b025bdaf3514eec1039bdfd3136719.exe
-
Size
12.3MB
-
MD5
c5b025bdaf3514eec1039bdfd3136719
-
SHA1
fde907f50ba9d3688ac89bbfbdb439882da654cf
-
SHA256
6eb81b659b7fdf4fd090a09e86d122dbcda216e56c5cb73677b4c01f81d7a1ea
-
SHA512
c3d6a2dc0be83a5d0b1546ce2a34d7f409190d924b5e282e9543ae4213bf95d22ff12f72a834aee8f24955d12aca29fda3d9e16a5aff777498d81e920bb87607
-
SSDEEP
49152:YRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBf:
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4416 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dnexasot\ImagePath = "C:\\Windows\\SysWOW64\\dnexasot\\abhqbxlt.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation c5b025bdaf3514eec1039bdfd3136719.exe -
Deletes itself 1 IoCs
pid Process 2832 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4924 abhqbxlt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4924 set thread context of 2832 4924 abhqbxlt.exe 121 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3328 sc.exe 1928 sc.exe 4580 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4632 4968 WerFault.exe 95 916 4924 WerFault.exe 113 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4968 wrote to memory of 3044 4968 c5b025bdaf3514eec1039bdfd3136719.exe 99 PID 4968 wrote to memory of 3044 4968 c5b025bdaf3514eec1039bdfd3136719.exe 99 PID 4968 wrote to memory of 3044 4968 c5b025bdaf3514eec1039bdfd3136719.exe 99 PID 4968 wrote to memory of 3952 4968 c5b025bdaf3514eec1039bdfd3136719.exe 101 PID 4968 wrote to memory of 3952 4968 c5b025bdaf3514eec1039bdfd3136719.exe 101 PID 4968 wrote to memory of 3952 4968 c5b025bdaf3514eec1039bdfd3136719.exe 101 PID 4968 wrote to memory of 3328 4968 c5b025bdaf3514eec1039bdfd3136719.exe 103 PID 4968 wrote to memory of 3328 4968 c5b025bdaf3514eec1039bdfd3136719.exe 103 PID 4968 wrote to memory of 3328 4968 c5b025bdaf3514eec1039bdfd3136719.exe 103 PID 4968 wrote to memory of 1928 4968 c5b025bdaf3514eec1039bdfd3136719.exe 105 PID 4968 wrote to memory of 1928 4968 c5b025bdaf3514eec1039bdfd3136719.exe 105 PID 4968 wrote to memory of 1928 4968 c5b025bdaf3514eec1039bdfd3136719.exe 105 PID 4968 wrote to memory of 4580 4968 c5b025bdaf3514eec1039bdfd3136719.exe 108 PID 4968 wrote to memory of 4580 4968 c5b025bdaf3514eec1039bdfd3136719.exe 108 PID 4968 wrote to memory of 4580 4968 c5b025bdaf3514eec1039bdfd3136719.exe 108 PID 4968 wrote to memory of 4416 4968 c5b025bdaf3514eec1039bdfd3136719.exe 114 PID 4968 wrote to memory of 4416 4968 c5b025bdaf3514eec1039bdfd3136719.exe 114 PID 4968 wrote to memory of 4416 4968 c5b025bdaf3514eec1039bdfd3136719.exe 114 PID 4924 wrote to memory of 2832 4924 abhqbxlt.exe 121 PID 4924 wrote to memory of 2832 4924 abhqbxlt.exe 121 PID 4924 wrote to memory of 2832 4924 abhqbxlt.exe 121 PID 4924 wrote to memory of 2832 4924 abhqbxlt.exe 121 PID 4924 wrote to memory of 2832 4924 abhqbxlt.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe"C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dnexasot\2⤵PID:3044
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\abhqbxlt.exe" C:\Windows\SysWOW64\dnexasot\2⤵PID:3952
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create dnexasot binPath= "C:\Windows\SysWOW64\dnexasot\abhqbxlt.exe /d\"C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3328
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description dnexasot "wifi internet conection"2⤵
- Launches sc.exe
PID:1928
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start dnexasot2⤵
- Launches sc.exe
PID:4580
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 12122⤵
- Program crash
PID:4632
-
-
C:\Windows\SysWOW64\dnexasot\abhqbxlt.exeC:\Windows\SysWOW64\dnexasot\abhqbxlt.exe /d"C:\Users\Admin\AppData\Local\Temp\c5b025bdaf3514eec1039bdfd3136719.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:2832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 5122⤵
- Program crash
PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4968 -ip 49681⤵PID:4376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4924 -ip 49241⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:1824
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.7MB
MD51eba9ddac3237d946ffa5626f6873f4a
SHA18e02b7360c0070b005cb030c4e0aa9695da985d4
SHA256269f1db7876f48c8fd88d97c5a77a01c47fd37d5806fbad1c03ed7774ca466e3
SHA512962f78b12e4e905fcd182c27a1c84eff5e7b849e5241fccb7d0fd33eae3805929b2775c74b7502df66bba82f5a95aa99314c5574397fa36248fec9df58dfc3cd