Overview
overview
10Static
static
306063b690d...77.exe
windows10-2004-x64
1006063b690d...77.exe
windows7-x64
1006063b690d...77.exe
windows10-1703-x64
1006063b690d...77.exe
windows10-2004-x64
706063b690d...77.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3Resubmissions
18-04-2024 11:46
240418-nxbcraca34 1018-04-2024 11:45
240418-nw8a4adb71 1018-04-2024 11:45
240418-nw7pkadb7x 1018-04-2024 11:45
240418-nw2tbabh97 1018-04-2024 11:45
240418-nw17sabh96 1018-04-2024 10:00
240418-l12m1ahg84 10Analysis
-
max time kernel
297s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
General
-
Target
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
-
Size
192KB
-
MD5
610b4e85369410c52cd2c1f1c1b304ae
-
SHA1
1a1288380b4abddb9830ff22541583ba66f76f2c
-
SHA256
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77
-
SHA512
46deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a
-
SSDEEP
3072:rf1BDZ0kVB67Duw9AMc+bP1Yf0wK8F78CrLFOmvJfnah+vbkWS90tqNu/mOspgI:r9X0GgP1k0I84Loafnah+TJqNfppJ
Malware Config
Extracted
systembc
172.104.63.157:4001
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
odfi.exeodfi.exeodfi.exeodfi.exeodfi.exeodfi.exepid process 5116 odfi.exe 5072 odfi.exe 1728 odfi.exe 3228 odfi.exe 1268 odfi.exe 3480 odfi.exe -
Loads dropped DLL 4 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exeodfi.exeodfi.exeodfi.exepid process 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 5116 odfi.exe 1728 odfi.exe 1268 odfi.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 40 api.ipify.org 41 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in System32 directory 3 IoCs
Processes:
odfi.exeodfi.exeodfi.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 odfi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 odfi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 odfi.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exeodfi.exeodfi.exeodfi.exedescription pid process target process PID 3232 set thread context of 1624 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe PID 5116 set thread context of 5072 5116 odfi.exe odfi.exe PID 1728 set thread context of 3228 1728 odfi.exe odfi.exe PID 1268 set thread context of 3480 1268 odfi.exe odfi.exe -
Drops file in Windows directory 2 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exedescription ioc process File created C:\Windows\Tasks\odfi.job 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe File opened for modification C:\Windows\Tasks\odfi.job 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\ProgramData\wvvkhw\odfi.exe nsis_installer_1 C:\ProgramData\wvvkhw\odfi.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exepid process 1624 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 1624 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exeodfi.exeodfi.exeodfi.exepid process 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 5116 odfi.exe 1728 odfi.exe 1268 odfi.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exeodfi.exeodfi.exeodfi.exedescription pid process target process PID 3232 wrote to memory of 1624 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe PID 3232 wrote to memory of 1624 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe PID 3232 wrote to memory of 1624 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe PID 3232 wrote to memory of 1624 3232 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe PID 5116 wrote to memory of 5072 5116 odfi.exe odfi.exe PID 5116 wrote to memory of 5072 5116 odfi.exe odfi.exe PID 5116 wrote to memory of 5072 5116 odfi.exe odfi.exe PID 5116 wrote to memory of 5072 5116 odfi.exe odfi.exe PID 1728 wrote to memory of 3228 1728 odfi.exe odfi.exe PID 1728 wrote to memory of 3228 1728 odfi.exe odfi.exe PID 1728 wrote to memory of 3228 1728 odfi.exe odfi.exe PID 1728 wrote to memory of 3228 1728 odfi.exe odfi.exe PID 1268 wrote to memory of 3480 1268 odfi.exe odfi.exe PID 1268 wrote to memory of 3480 1268 odfi.exe odfi.exe PID 1268 wrote to memory of 3480 1268 odfi.exe odfi.exe PID 1268 wrote to memory of 3480 1268 odfi.exe odfi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start2⤵
- Executes dropped EXE
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start2⤵
- Executes dropped EXE
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wvvkhw\odfi.exeC:\ProgramData\wvvkhw\odfi.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\wvvkhw\odfi.exeFilesize
192KB
MD5610b4e85369410c52cd2c1f1c1b304ae
SHA11a1288380b4abddb9830ff22541583ba66f76f2c
SHA25606063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77
SHA51246deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a
-
C:\Users\Admin\AppData\Local\Temp\nsv79F4.tmp\System.dllFilesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123Filesize
150KB
MD5b76e1d1a677d5ab98d816c5fd5874e9e
SHA1f7482d1b6b5e446f5d11848d40872f790ef671e3
SHA256cd2eb21478199118d1f113b8a5c36b3d3a7e19a4a7d963f48b8df14eba6ea10c
SHA5121ab74e04671abe7d685b6e7100a0a12b78cae00c3bd24c68f0ceebaf8924ee28bb582d4ef74bcd08c1f5e3a309e0468a845a630e118baf0f324a41c663d2a4be
-
memory/1624-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1624-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1624-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB