Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
dec340af99d11d4bda18bafe03b2172f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dec340af99d11d4bda18bafe03b2172f.exe
Resource
win10v2004-20240226-en
General
-
Target
dec340af99d11d4bda18bafe03b2172f.exe
-
Size
14.9MB
-
MD5
dec340af99d11d4bda18bafe03b2172f
-
SHA1
08712f078b5470ee9a7398c8662af4269b749da3
-
SHA256
7d34075aebc551801edcf950ad816a5f277522f2d6b53679e7bd2921d89e0c4f
-
SHA512
4125d79a9a9f1288e8fdaf5477c47f0c6ef8c522ae639842b334847a7ed1668126ee0ff8eae59dac20808e6b64959027bb6bb811d10f2cfb43c551374bf07a1d
-
SSDEEP
49152:2yqI2kmso555555555555555555555555555555555555555555555555555555t:2yqI2
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\swmbeksk = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2748 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\swmbeksk\ImagePath = "C:\\Windows\\SysWOW64\\swmbeksk\\xrritctv.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2432 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2576 xrritctv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2576 set thread context of 2432 2576 xrritctv.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2692 sc.exe 2652 sc.exe 2448 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2932 2656 dec340af99d11d4bda18bafe03b2172f.exe 28 PID 2656 wrote to memory of 2932 2656 dec340af99d11d4bda18bafe03b2172f.exe 28 PID 2656 wrote to memory of 2932 2656 dec340af99d11d4bda18bafe03b2172f.exe 28 PID 2656 wrote to memory of 2932 2656 dec340af99d11d4bda18bafe03b2172f.exe 28 PID 2656 wrote to memory of 2632 2656 dec340af99d11d4bda18bafe03b2172f.exe 30 PID 2656 wrote to memory of 2632 2656 dec340af99d11d4bda18bafe03b2172f.exe 30 PID 2656 wrote to memory of 2632 2656 dec340af99d11d4bda18bafe03b2172f.exe 30 PID 2656 wrote to memory of 2632 2656 dec340af99d11d4bda18bafe03b2172f.exe 30 PID 2656 wrote to memory of 2692 2656 dec340af99d11d4bda18bafe03b2172f.exe 32 PID 2656 wrote to memory of 2692 2656 dec340af99d11d4bda18bafe03b2172f.exe 32 PID 2656 wrote to memory of 2692 2656 dec340af99d11d4bda18bafe03b2172f.exe 32 PID 2656 wrote to memory of 2692 2656 dec340af99d11d4bda18bafe03b2172f.exe 32 PID 2656 wrote to memory of 2652 2656 dec340af99d11d4bda18bafe03b2172f.exe 34 PID 2656 wrote to memory of 2652 2656 dec340af99d11d4bda18bafe03b2172f.exe 34 PID 2656 wrote to memory of 2652 2656 dec340af99d11d4bda18bafe03b2172f.exe 34 PID 2656 wrote to memory of 2652 2656 dec340af99d11d4bda18bafe03b2172f.exe 34 PID 2656 wrote to memory of 2448 2656 dec340af99d11d4bda18bafe03b2172f.exe 36 PID 2656 wrote to memory of 2448 2656 dec340af99d11d4bda18bafe03b2172f.exe 36 PID 2656 wrote to memory of 2448 2656 dec340af99d11d4bda18bafe03b2172f.exe 36 PID 2656 wrote to memory of 2448 2656 dec340af99d11d4bda18bafe03b2172f.exe 36 PID 2656 wrote to memory of 2748 2656 dec340af99d11d4bda18bafe03b2172f.exe 38 PID 2656 wrote to memory of 2748 2656 dec340af99d11d4bda18bafe03b2172f.exe 38 PID 2656 wrote to memory of 2748 2656 dec340af99d11d4bda18bafe03b2172f.exe 38 PID 2656 wrote to memory of 2748 2656 dec340af99d11d4bda18bafe03b2172f.exe 38 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41 PID 2576 wrote to memory of 2432 2576 xrritctv.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe"C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\swmbeksk\2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrritctv.exe" C:\Windows\SysWOW64\swmbeksk\2⤵PID:2632
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create swmbeksk binPath= "C:\Windows\SysWOW64\swmbeksk\xrritctv.exe /d\"C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2692
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description swmbeksk "wifi internet conection"2⤵
- Launches sc.exe
PID:2652
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start swmbeksk2⤵
- Launches sc.exe
PID:2448
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2748
-
-
C:\Windows\SysWOW64\swmbeksk\xrritctv.exeC:\Windows\SysWOW64\swmbeksk\xrritctv.exe /d"C:\Users\Admin\AppData\Local\Temp\dec340af99d11d4bda18bafe03b2172f.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD56f578b58b5a64d772aa55856ef4fbdcf
SHA18f2e254596172239f2d806600880a5c6942fea51
SHA256b9c699a14f19135b75b3075503866d17081365801768bb823e1ffe201c9ba0fb
SHA512a3150eaff9bfce0ceb308bfc178ee17467c21d02f1db80909d8181381c2aaa1fe1bc5b3843d6dc0901bb6947a0804d1c3d08c288f4edef674dbf80927a7348af
-
Filesize
1.1MB
MD5c4e23be772e5e12730db06e72ba7e9f0
SHA140350b79ae346a8367d645ef18227c6495f4d21b
SHA25676ba89131581366b996fd420062ae86332b554316df38d93229d3dc000df2365
SHA51269e501bd798adc992f8ba03a7d8e1221bfce343da7c9af242f39dbfe6d00ddd81d308002371be830b312d1d67413372901736c2e1d9fba114fc0bdfdb3221070