Overview
overview
10Static
static
306063b690d...77.exe
windows10-2004-x64
1006063b690d...77.exe
windows7-x64
1006063b690d...77.exe
windows10-1703-x64
1006063b690d...77.exe
windows10-2004-x64
1006063b690d...77.exe
windows11-21h2-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3Resubmissions
18/04/2024, 11:46
240418-nxbcraca341018/04/2024, 11:45
240418-nw8a4adb711018/04/2024, 11:45
240418-nw7pkadb7x1018/04/2024, 11:45
240418-nw2tbabh971018/04/2024, 11:45
240418-nw17sabh961018/04/2024, 10:00
240418-l12m1ahg8410Analysis
- max time kernel
1200s - max time network
1203s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
18/04/2024, 11:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
1200 seconds
Behavioral task
behavioral3
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
1200 seconds
Behavioral task
behavioral4
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
1200 seconds
Behavioral task
behavioral5
Sample
06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
Resource
win11-20240412-en
windows11-21h2-x64
13 signatures
1200 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
1200 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
1200 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
windows11-21h2-x64
2 signatures
1200 seconds
General
- Target 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe
- Size 192KB
- Sample240418-nw8a4adb71
- SHA256 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77
- MD5 610b4e85369410c52cd2c1f1c1b304ae
- SHA1 1a1288380b4abddb9830ff22541583ba66f76f2c
- SHA512 46deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a
- SSDEEP 3072:rf1BDZ0kVB67Duw9AMc+bP1Yf0wK8F78CrLFOmvJfnah+vbkWS90tqNu/mOspgI:r9X0GgP1k0I84Loafnah+TJqNfppJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
systembc
C2
-
172.104.63.157:4001
Signatures
- Contacts a large (652) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 20 IoCs
pid Process 1744 xlfvgp.exe 2528 xlfvgp.exe 2640 xlfvgp.exe 2272 xlfvgp.exe 2392 xlfvgp.exe 1280 xlfvgp.exe 2344 xlfvgp.exe 836 xlfvgp.exe 1600 xlfvgp.exe 2056 xlfvgp.exe 1908 xlfvgp.exe 2248 xlfvgp.exe 1588 xlfvgp.exe 1192 xlfvgp.exe 1720 xlfvgp.exe 772 xlfvgp.exe 2888 xlfvgp.exe 2664 xlfvgp.exe 932 xlfvgp.exe 2216 xlfvgp.exe - Loads dropped DLL 11 IoCs
pid Process 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 1744 xlfvgp.exe 2640 xlfvgp.exe 2392 xlfvgp.exe 2344 xlfvgp.exe 1600 xlfvgp.exe 1908 xlfvgp.exe 1588 xlfvgp.exe 1720 xlfvgp.exe 2888 xlfvgp.exe 932 xlfvgp.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 88.216.223.2 - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 6 ip4.seeip.org - Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123 xlfvgp.exe - Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 2204 set thread context of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 1744 set thread context of 2528 1744 xlfvgp.exe 31 PID 2640 set thread context of 2272 2640 xlfvgp.exe 35 PID 2392 set thread context of 1280 2392 xlfvgp.exe 37 PID 2344 set thread context of 836 2344 xlfvgp.exe 39 PID 1600 set thread context of 2056 1600 xlfvgp.exe 41 PID 1908 set thread context of 2248 1908 xlfvgp.exe 43 PID 1588 set thread context of 1192 1588 xlfvgp.exe 45 PID 1720 set thread context of 772 1720 xlfvgp.exe 47 PID 2888 set thread context of 2664 2888 xlfvgp.exe 49 PID 932 set thread context of 2216 932 xlfvgp.exe 51 - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\xlfvgp.job 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe File opened for modification C:\Windows\Tasks\xlfvgp.job 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0009000000012345-15.dat nsis_installer_1 behavioral2/files/0x0009000000012345-15.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2556 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe - Suspicious behavior: MapViewOfSection 11 IoCs
pid Process 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 1744 xlfvgp.exe 2640 xlfvgp.exe 2392 xlfvgp.exe 2344 xlfvgp.exe 1600 xlfvgp.exe 1908 xlfvgp.exe 1588 xlfvgp.exe 1720 xlfvgp.exe 2888 xlfvgp.exe 932 xlfvgp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 2204 wrote to memory of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 2204 wrote to memory of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 2204 wrote to memory of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 2204 wrote to memory of 2556 2204 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe 28 PID 2540 wrote to memory of 1744 2540 taskeng.exe 30 PID 2540 wrote to memory of 1744 2540 taskeng.exe 30 PID 2540 wrote to memory of 1744 2540 taskeng.exe 30 PID 2540 wrote to memory of 1744 2540 taskeng.exe 30 PID 1744 wrote to memory of 2528 1744 xlfvgp.exe 31 PID 1744 wrote to memory of 2528 1744 xlfvgp.exe 31 PID 1744 wrote to memory of 2528 1744 xlfvgp.exe 31 PID 1744 wrote to memory of 2528 1744 xlfvgp.exe 31 PID 1744 wrote to memory of 2528 1744 xlfvgp.exe 31 PID 2540 wrote to memory of 2640 2540 taskeng.exe 34 PID 2540 wrote to memory of 2640 2540 taskeng.exe 34 PID 2540 wrote to memory of 2640 2540 taskeng.exe 34 PID 2540 wrote to memory of 2640 2540 taskeng.exe 34 PID 2640 wrote to memory of 2272 2640 xlfvgp.exe 35 PID 2640 wrote to memory of 2272 2640 xlfvgp.exe 35 PID 2640 wrote to memory of 2272 2640 xlfvgp.exe 35 PID 2640 wrote to memory of 2272 2640 xlfvgp.exe 35 PID 2640 wrote to memory of 2272 2640 xlfvgp.exe 35 PID 2540 wrote to memory of 2392 2540 taskeng.exe 36 PID 2540 wrote to memory of 2392 2540 taskeng.exe 36 PID 2540 wrote to memory of 2392 2540 taskeng.exe 36 PID 2540 wrote to memory of 2392 2540 taskeng.exe 36 PID 2392 wrote to memory of 1280 2392 xlfvgp.exe 37 PID 2392 wrote to memory of 1280 2392 xlfvgp.exe 37 PID 2392 wrote to memory of 1280 2392 xlfvgp.exe 37 PID 2392 wrote to memory of 1280 2392 xlfvgp.exe 37 PID 2392 wrote to memory of 1280 2392 xlfvgp.exe 37 PID 2540 wrote to memory of 2344 2540 taskeng.exe 38 PID 2540 wrote to memory of 2344 2540 taskeng.exe 38 PID 2540 wrote to memory of 2344 2540 taskeng.exe 38 PID 2540 wrote to memory of 2344 2540 taskeng.exe 38 PID 2344 wrote to memory of 836 2344 xlfvgp.exe 39 PID 2344 wrote to memory of 836 2344 xlfvgp.exe 39 PID 2344 wrote to memory of 836 2344 xlfvgp.exe 39 PID 2344 wrote to memory of 836 2344 xlfvgp.exe 39 PID 2344 wrote to memory of 836 2344 xlfvgp.exe 39 PID 2540 wrote to memory of 1600 2540 taskeng.exe 40 PID 2540 wrote to memory of 1600 2540 taskeng.exe 40 PID 2540 wrote to memory of 1600 2540 taskeng.exe 40 PID 2540 wrote to memory of 1600 2540 taskeng.exe 40 PID 1600 wrote to memory of 2056 1600 xlfvgp.exe 41 PID 1600 wrote to memory of 2056 1600 xlfvgp.exe 41 PID 1600 wrote to memory of 2056 1600 xlfvgp.exe 41 PID 1600 wrote to memory of 2056 1600 xlfvgp.exe 41 PID 1600 wrote to memory of 2056 1600 xlfvgp.exe 41 PID 2540 wrote to memory of 1908 2540 taskeng.exe 42 PID 2540 wrote to memory of 1908 2540 taskeng.exe 42 PID 2540 wrote to memory of 1908 2540 taskeng.exe 42 PID 2540 wrote to memory of 1908 2540 taskeng.exe 42 PID 1908 wrote to memory of 2248 1908 xlfvgp.exe 43 PID 1908 wrote to memory of 2248 1908 xlfvgp.exe 43 PID 1908 wrote to memory of 2248 1908 xlfvgp.exe 43 PID 1908 wrote to memory of 2248 1908 xlfvgp.exe 43 PID 1908 wrote to memory of 2248 1908 xlfvgp.exe 43 PID 2540 wrote to memory of 1588 2540 taskeng.exe 44 PID 2540 wrote to memory of 1588 2540 taskeng.exe 44 PID 2540 wrote to memory of 1588 2540 taskeng.exe 44 PID 2540 wrote to memory of 1588 2540 taskeng.exe 44 PID 1588 wrote to memory of 1192 1588 xlfvgp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"C:\Users\Admin\AppData\Local\Temp\06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EA7D2370-46C8-4CC1-BA37-2F793C397FE7} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2528
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2272
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:1280
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:836
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2056
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2248
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:1192
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1720 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:772
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2888 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2664
-
-
-
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:932 -
C:\ProgramData\mopqs\xlfvgp.exeC:\ProgramData\mopqs\xlfvgp.exe start3⤵
- Executes dropped EXE
PID:2216
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\mopqs\xlfvgp.exe
- Size 192KB
- SHA256 06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77
- MD5 610b4e85369410c52cd2c1f1c1b304ae
- SHA1 1a1288380b4abddb9830ff22541583ba66f76f2c
- SHA512 46deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a
- SSDEEP 3072:rf1BDZ0kVB67Duw9AMc+bP1Yf0wK8F78CrLFOmvJfnah+vbkWS90tqNu/mOspgI:r9X0GgP1k0I84Loafnah+TJqNfppJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\528123
- Size 150KB
- SHA256 cd2eb21478199118d1f113b8a5c36b3d3a7e19a4a7d963f48b8df14eba6ea10c
- MD5 b76e1d1a677d5ab98d816c5fd5874e9e
- SHA1 f7482d1b6b5e446f5d11848d40872f790ef671e3
- SHA512 1ab74e04671abe7d685b6e7100a0a12b78cae00c3bd24c68f0ceebaf8924ee28bb582d4ef74bcd08c1f5e3a309e0468a845a630e118baf0f324a41c663d2a4be
- SSDEEP 3072:91Yf0wK8/78CrLFOmnJfnah+vbF5jwl/qCkkMbVwgGcdvNu/mOA:91k0o84Logfnah+TF5jwXM6g3vNfP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsy639.tmp\System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP