Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
dea2ca171f528876b5bb42ac2630b2fb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dea2ca171f528876b5bb42ac2630b2fb.exe
Resource
win10v2004-20240226-en
General
-
Target
dea2ca171f528876b5bb42ac2630b2fb.exe
-
Size
11.8MB
-
MD5
dea2ca171f528876b5bb42ac2630b2fb
-
SHA1
3ad94d0eb736834da2689c6b806906deaf0f2a60
-
SHA256
ffbe4fc61de6a70ab99966df71a5b4ebf80ae6646020679a8a27e450b9b4240b
-
SHA512
e76389468c8b90a28e211c4de6a8873ae3c51cdd43feec7ef359ba6fab325004c718ac87e9a6e11850a20abfd5ede120d506f48f83ff5487a07e7f1193ffc585
-
SSDEEP
98304:vjhd88888888888888888888888888888888888888888888888888888888888Q:v
Malware Config
Extracted
tofsee
176.111.174.19
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qctzrsdf = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2724 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qctzrsdf\ImagePath = "C:\\Windows\\SysWOW64\\qctzrsdf\\gsrwvnlw.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 1904 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2584 gsrwvnlw.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2584 set thread context of 1904 2584 gsrwvnlw.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2696 sc.exe 2168 sc.exe 2664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2384 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 28 PID 1884 wrote to memory of 2384 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 28 PID 1884 wrote to memory of 2384 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 28 PID 1884 wrote to memory of 2384 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 28 PID 1884 wrote to memory of 940 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 30 PID 1884 wrote to memory of 940 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 30 PID 1884 wrote to memory of 940 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 30 PID 1884 wrote to memory of 940 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 30 PID 1884 wrote to memory of 2168 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 32 PID 1884 wrote to memory of 2168 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 32 PID 1884 wrote to memory of 2168 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 32 PID 1884 wrote to memory of 2168 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 32 PID 1884 wrote to memory of 2664 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 34 PID 1884 wrote to memory of 2664 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 34 PID 1884 wrote to memory of 2664 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 34 PID 1884 wrote to memory of 2664 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 34 PID 1884 wrote to memory of 2696 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 36 PID 1884 wrote to memory of 2696 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 36 PID 1884 wrote to memory of 2696 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 36 PID 1884 wrote to memory of 2696 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 36 PID 1884 wrote to memory of 2724 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 39 PID 1884 wrote to memory of 2724 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 39 PID 1884 wrote to memory of 2724 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 39 PID 1884 wrote to memory of 2724 1884 dea2ca171f528876b5bb42ac2630b2fb.exe 39 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41 PID 2584 wrote to memory of 1904 2584 gsrwvnlw.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\dea2ca171f528876b5bb42ac2630b2fb.exe"C:\Users\Admin\AppData\Local\Temp\dea2ca171f528876b5bb42ac2630b2fb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qctzrsdf\2⤵PID:2384
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gsrwvnlw.exe" C:\Windows\SysWOW64\qctzrsdf\2⤵PID:940
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qctzrsdf binPath= "C:\Windows\SysWOW64\qctzrsdf\gsrwvnlw.exe /d\"C:\Users\Admin\AppData\Local\Temp\dea2ca171f528876b5bb42ac2630b2fb.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2168
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qctzrsdf "wifi internet conection"2⤵
- Launches sc.exe
PID:2664
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qctzrsdf2⤵
- Launches sc.exe
PID:2696
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2724
-
-
C:\Windows\SysWOW64\qctzrsdf\gsrwvnlw.exeC:\Windows\SysWOW64\qctzrsdf\gsrwvnlw.exe /d"C:\Users\Admin\AppData\Local\Temp\dea2ca171f528876b5bb42ac2630b2fb.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1904
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD5d2d2399e50da5ea1a6401e0195f34227
SHA13a0abf0063a9ad97814024c68cbabcab455409e7
SHA256ef89b802cebf7c78c107df553e57179ad78fe95545f916fd985263affeea3686
SHA5129f0b3f4080cb2eaf89e07dbfae2eb46012f2f80f662ef998be8a22a9a0784d09d763e2c3bd824d4f66a714aaf954f5441542ad39faeb294a21526436f70ffde3