Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
debe4a88a9ba02f69a42ff9d1d3db1aa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
debe4a88a9ba02f69a42ff9d1d3db1aa.exe
Resource
win10v2004-20240226-en
General
-
Target
debe4a88a9ba02f69a42ff9d1d3db1aa.exe
-
Size
14.0MB
-
MD5
debe4a88a9ba02f69a42ff9d1d3db1aa
-
SHA1
75c854472d822031d61d90a995b68b91e3aee286
-
SHA256
40ed19717bc806f511f30549b4be0b5968677539034246531127419781a09933
-
SHA512
e741bffdecf5cb0098ea850bd45cd48ee1df9085153b4873ecaf30f5cba2b7bbb53957973d706ee9640453e24ca2f4782fde1fae36a01ae7e8e1c3e645da6d51
-
SSDEEP
49152:SGvEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE:SG
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4788 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fssxqypz\ImagePath = "C:\\Windows\\SysWOW64\\fssxqypz\\yqynvtxv.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation debe4a88a9ba02f69a42ff9d1d3db1aa.exe -
Deletes itself 1 IoCs
pid Process 4560 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1164 yqynvtxv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1164 set thread context of 4560 1164 yqynvtxv.exe 111 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1780 sc.exe 920 sc.exe 3968 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3780 776 WerFault.exe 86 432 1164 WerFault.exe 104 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 776 wrote to memory of 1464 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 92 PID 776 wrote to memory of 1464 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 92 PID 776 wrote to memory of 1464 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 92 PID 776 wrote to memory of 4804 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 96 PID 776 wrote to memory of 4804 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 96 PID 776 wrote to memory of 4804 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 96 PID 776 wrote to memory of 1780 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 98 PID 776 wrote to memory of 1780 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 98 PID 776 wrote to memory of 1780 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 98 PID 776 wrote to memory of 920 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 100 PID 776 wrote to memory of 920 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 100 PID 776 wrote to memory of 920 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 100 PID 776 wrote to memory of 3968 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 102 PID 776 wrote to memory of 3968 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 102 PID 776 wrote to memory of 3968 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 102 PID 776 wrote to memory of 4788 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 105 PID 776 wrote to memory of 4788 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 105 PID 776 wrote to memory of 4788 776 debe4a88a9ba02f69a42ff9d1d3db1aa.exe 105 PID 1164 wrote to memory of 4560 1164 yqynvtxv.exe 111 PID 1164 wrote to memory of 4560 1164 yqynvtxv.exe 111 PID 1164 wrote to memory of 4560 1164 yqynvtxv.exe 111 PID 1164 wrote to memory of 4560 1164 yqynvtxv.exe 111 PID 1164 wrote to memory of 4560 1164 yqynvtxv.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\debe4a88a9ba02f69a42ff9d1d3db1aa.exe"C:\Users\Admin\AppData\Local\Temp\debe4a88a9ba02f69a42ff9d1d3db1aa.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fssxqypz\2⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yqynvtxv.exe" C:\Windows\SysWOW64\fssxqypz\2⤵PID:4804
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fssxqypz binPath= "C:\Windows\SysWOW64\fssxqypz\yqynvtxv.exe /d\"C:\Users\Admin\AppData\Local\Temp\debe4a88a9ba02f69a42ff9d1d3db1aa.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1780
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fssxqypz "wifi internet conection"2⤵
- Launches sc.exe
PID:920
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fssxqypz2⤵
- Launches sc.exe
PID:3968
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 12242⤵
- Program crash
PID:3780
-
-
C:\Windows\SysWOW64\fssxqypz\yqynvtxv.exeC:\Windows\SysWOW64\fssxqypz\yqynvtxv.exe /d"C:\Users\Admin\AppData\Local\Temp\debe4a88a9ba02f69a42ff9d1d3db1aa.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:4560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 5122⤵
- Program crash
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 776 -ip 7761⤵PID:2520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1164 -ip 11641⤵PID:4228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD546efa9361858c0f5ef41eda6261ad609
SHA106ab4c49bfec0d575bc8cc8e9266c42f9bd284ab
SHA2563646dd39f0674b14b8666dff0755fd429177f7611316a319152326a981c4a014
SHA5121afe16a3f78f80022f6247ecf729c384164c0e049b612177ee3b5ca561c1fe915539a87fa0931a36570be2a7736a0a93fbc384d2f3624035c9a4c5a9f38ef361