Analysis
-
max time kernel
164s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
defc1cba4b8990663ca51d25a32af585.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
defc1cba4b8990663ca51d25a32af585.exe
Resource
win10v2004-20240226-en
General
-
Target
defc1cba4b8990663ca51d25a32af585.exe
-
Size
10.4MB
-
MD5
defc1cba4b8990663ca51d25a32af585
-
SHA1
1a8a9c95794480980c208ceecdb4cedc4a09b058
-
SHA256
5ab3671466c3136f8b9cd603f45ce7a038c9b8ed2ea58a713c5fff6a0928f729
-
SHA512
0402ca1c999925d96c892252a1d9dd4276f258fb30a622b347e45da1acaa994be0f6893db5383d86bc10f12b8b7c5af7372a71826f946a05d9270b5bb3986f76
-
SSDEEP
24576:0erU5sWbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb7:0sW
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gbcvsuxt = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2580 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gbcvsuxt\ImagePath = "C:\\Windows\\SysWOW64\\gbcvsuxt\\foesthwc.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2384 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2416 foesthwc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2416 set thread context of 2384 2416 foesthwc.exe 42 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2624 sc.exe 2612 sc.exe 2528 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1748 wrote to memory of 1872 1748 defc1cba4b8990663ca51d25a32af585.exe 27 PID 1748 wrote to memory of 1872 1748 defc1cba4b8990663ca51d25a32af585.exe 27 PID 1748 wrote to memory of 1872 1748 defc1cba4b8990663ca51d25a32af585.exe 27 PID 1748 wrote to memory of 1872 1748 defc1cba4b8990663ca51d25a32af585.exe 27 PID 1748 wrote to memory of 1504 1748 defc1cba4b8990663ca51d25a32af585.exe 29 PID 1748 wrote to memory of 1504 1748 defc1cba4b8990663ca51d25a32af585.exe 29 PID 1748 wrote to memory of 1504 1748 defc1cba4b8990663ca51d25a32af585.exe 29 PID 1748 wrote to memory of 1504 1748 defc1cba4b8990663ca51d25a32af585.exe 29 PID 1748 wrote to memory of 2624 1748 defc1cba4b8990663ca51d25a32af585.exe 31 PID 1748 wrote to memory of 2624 1748 defc1cba4b8990663ca51d25a32af585.exe 31 PID 1748 wrote to memory of 2624 1748 defc1cba4b8990663ca51d25a32af585.exe 31 PID 1748 wrote to memory of 2624 1748 defc1cba4b8990663ca51d25a32af585.exe 31 PID 1748 wrote to memory of 2612 1748 defc1cba4b8990663ca51d25a32af585.exe 33 PID 1748 wrote to memory of 2612 1748 defc1cba4b8990663ca51d25a32af585.exe 33 PID 1748 wrote to memory of 2612 1748 defc1cba4b8990663ca51d25a32af585.exe 33 PID 1748 wrote to memory of 2612 1748 defc1cba4b8990663ca51d25a32af585.exe 33 PID 1748 wrote to memory of 2528 1748 defc1cba4b8990663ca51d25a32af585.exe 35 PID 1748 wrote to memory of 2528 1748 defc1cba4b8990663ca51d25a32af585.exe 35 PID 1748 wrote to memory of 2528 1748 defc1cba4b8990663ca51d25a32af585.exe 35 PID 1748 wrote to memory of 2528 1748 defc1cba4b8990663ca51d25a32af585.exe 35 PID 1748 wrote to memory of 2580 1748 defc1cba4b8990663ca51d25a32af585.exe 37 PID 1748 wrote to memory of 2580 1748 defc1cba4b8990663ca51d25a32af585.exe 37 PID 1748 wrote to memory of 2580 1748 defc1cba4b8990663ca51d25a32af585.exe 37 PID 1748 wrote to memory of 2580 1748 defc1cba4b8990663ca51d25a32af585.exe 37 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42 PID 2416 wrote to memory of 2384 2416 foesthwc.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\defc1cba4b8990663ca51d25a32af585.exe"C:\Users\Admin\AppData\Local\Temp\defc1cba4b8990663ca51d25a32af585.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gbcvsuxt\2⤵PID:1872
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\foesthwc.exe" C:\Windows\SysWOW64\gbcvsuxt\2⤵PID:1504
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create gbcvsuxt binPath= "C:\Windows\SysWOW64\gbcvsuxt\foesthwc.exe /d\"C:\Users\Admin\AppData\Local\Temp\defc1cba4b8990663ca51d25a32af585.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2624
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description gbcvsuxt "wifi internet conection"2⤵
- Launches sc.exe
PID:2612
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start gbcvsuxt2⤵
- Launches sc.exe
PID:2528
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2580
-
-
C:\Windows\SysWOW64\gbcvsuxt\foesthwc.exeC:\Windows\SysWOW64\gbcvsuxt\foesthwc.exe /d"C:\Users\Admin\AppData\Local\Temp\defc1cba4b8990663ca51d25a32af585.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.4MB
MD53516364e331c80b4d17a6bf8247077e9
SHA10f6e417d2629c168a3d54f23f2f757ee294da5e7
SHA256223abf8eac1b1bd1db3bdee22635ad841df31d1dd405744dcc54ee906c9c8e32
SHA5127232cfb3c05f7ed3314e8f6e32ecf97cf03ab8a5521cd54f9249fe7018fddeb88803477662c24adc4f0c162272c336ec76c219eeb16a53e213c48227948f8cfb