Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
deb0c884cd5bdf35238e063bc643c2e5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
deb0c884cd5bdf35238e063bc643c2e5.exe
Resource
win10v2004-20240226-en
General
-
Target
deb0c884cd5bdf35238e063bc643c2e5.exe
-
Size
11.7MB
-
MD5
deb0c884cd5bdf35238e063bc643c2e5
-
SHA1
79a9bb56636321130ad4a6e031026521a645e195
-
SHA256
69124d1b3d101c9199c4d39f766ac185a8a0bd2f191b1295fb2d5780a3b0f38b
-
SHA512
730ac2567491cb39d321a34cabb93db0cabb9bf1f55563facd4092375d3f95fe823540301ec95ba7f6c07cae355fb6062cf8567863b0b28cbfe7af0c510e530b
-
SSDEEP
49152:m88888888888888888888888888888888888888888888888888888888888888f:
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\myvqpluh = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2588 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\myvqpluh\ImagePath = "C:\\Windows\\SysWOW64\\myvqpluh\\cgnrtwmy.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 1668 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2608 cgnrtwmy.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2608 set thread context of 1668 2608 cgnrtwmy.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3048 sc.exe 2560 sc.exe 2704 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2984 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 28 PID 2360 wrote to memory of 2984 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 28 PID 2360 wrote to memory of 2984 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 28 PID 2360 wrote to memory of 2984 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 28 PID 2360 wrote to memory of 3000 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 30 PID 2360 wrote to memory of 3000 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 30 PID 2360 wrote to memory of 3000 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 30 PID 2360 wrote to memory of 3000 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 30 PID 2360 wrote to memory of 3048 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 32 PID 2360 wrote to memory of 3048 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 32 PID 2360 wrote to memory of 3048 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 32 PID 2360 wrote to memory of 3048 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 32 PID 2360 wrote to memory of 2560 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 34 PID 2360 wrote to memory of 2560 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 34 PID 2360 wrote to memory of 2560 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 34 PID 2360 wrote to memory of 2560 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 34 PID 2360 wrote to memory of 2704 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 36 PID 2360 wrote to memory of 2704 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 36 PID 2360 wrote to memory of 2704 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 36 PID 2360 wrote to memory of 2704 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 36 PID 2360 wrote to memory of 2588 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 39 PID 2360 wrote to memory of 2588 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 39 PID 2360 wrote to memory of 2588 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 39 PID 2360 wrote to memory of 2588 2360 deb0c884cd5bdf35238e063bc643c2e5.exe 39 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41 PID 2608 wrote to memory of 1668 2608 cgnrtwmy.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\deb0c884cd5bdf35238e063bc643c2e5.exe"C:\Users\Admin\AppData\Local\Temp\deb0c884cd5bdf35238e063bc643c2e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\myvqpluh\2⤵PID:2984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cgnrtwmy.exe" C:\Windows\SysWOW64\myvqpluh\2⤵PID:3000
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create myvqpluh binPath= "C:\Windows\SysWOW64\myvqpluh\cgnrtwmy.exe /d\"C:\Users\Admin\AppData\Local\Temp\deb0c884cd5bdf35238e063bc643c2e5.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3048
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description myvqpluh "wifi internet conection"2⤵
- Launches sc.exe
PID:2560
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start myvqpluh2⤵
- Launches sc.exe
PID:2704
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2588
-
-
C:\Windows\SysWOW64\myvqpluh\cgnrtwmy.exeC:\Windows\SysWOW64\myvqpluh\cgnrtwmy.exe /d"C:\Users\Admin\AppData\Local\Temp\deb0c884cd5bdf35238e063bc643c2e5.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1668
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5ffb26617c9b107568cd960ac9308e371
SHA1da31196bf4831fd1d25d5f400ddffc19befa553e
SHA256ac36ec8d597954e2d004e65c8ec59d33ddbac90bb2053cda0c718ee29f0ba1e2
SHA5127bec8ed392a7eebe14ff288c93f440fc99cb800e965f929369255726e6075d93d8d045911ef0b4447e9f17e2fba02c83b3ff7d2a40cb9a1ddcf785797e7415b2
-
Filesize
4.2MB
MD5b0e8f710765cbaa3e033d78f50be69f3
SHA1872dceab9ce447b1dc1c67b79f5c0b673cda7e61
SHA256e254c831064534096434f1fac6c98ddaa5f81db5f9d67ac1b43e34472e1314f6
SHA51244b4c06c8239c644751e01008864ed294c468ca7c1af884b069c1954490f50ddddd0dca7bc114999eb4c8f0ca29ecf13a143e32d5e2d5ad29e1110fa03aa08b0