Overview
overview
10Static
static
101acfdefd7d...c4.exe
windows7-x64
101acfdefd7d...c4.exe
windows10-2004-x64
1020de026bf4...60.exe
windows7-x64
1020de026bf4...60.exe
windows10-2004-x64
10353b1a5ced...52.exe
windows7-x64
10353b1a5ced...52.exe
windows10-2004-x64
1037a4514026...30.exe
windows7-x64
1037a4514026...30.exe
windows10-2004-x64
1060121ea2ab...3e.exe
windows7-x64
1060121ea2ab...3e.exe
windows10-2004-x64
96ac062d21f...22.exe
windows7-x64
106ac062d21f...22.exe
windows10-2004-x64
76db9f96b1c...da.exe
windows7-x64
106db9f96b1c...da.exe
windows10-2004-x64
1071f510c40f...cf.exe
windows7-x64
1071f510c40f...cf.exe
windows10-2004-x64
1074e40db78f...83.exe
windows7-x64
1074e40db78f...83.exe
windows10-2004-x64
108245c3b357...fe.exe
windows7-x64
108245c3b357...fe.exe
windows10-2004-x64
1099829d5483...fd.exe
windows7-x64
799829d5483...fd.exe
windows10-2004-x64
79d07b89cd6...7e.exe
windows7-x64
109d07b89cd6...7e.exe
windows10-2004-x64
10b8665cf00d...53.exe
windows7-x64
10b8665cf00d...53.exe
windows10-2004-x64
10ce7606cfdf...c3.exe
windows7-x64
10ce7606cfdf...c3.exe
windows10-2004-x64
10da4a56f9db...1a.exe
windows7-x64
10da4a56f9db...1a.exe
windows10-2004-x64
10f1ee32e471...c2.exe
windows7-x64
10f1ee32e471...c2.exe
windows10-2004-x64
10Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 23:05
Behavioral task
behavioral1
Sample
1acfdefd7d823688159e6369f5f32ec4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1acfdefd7d823688159e6369f5f32ec4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
20de026bf4998364c894a00f7a97df60.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
20de026bf4998364c894a00f7a97df60.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
353b1a5ced1e9c3341cf45160576b852.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
353b1a5ced1e9c3341cf45160576b852.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
37a4514026f67eeebd5a8f6786a92e30.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
37a4514026f67eeebd5a8f6786a92e30.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
60121ea2ab380455f7e143cd9438443e.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
60121ea2ab380455f7e143cd9438443e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
6ac062d21f08f139d9f3d1e335e72e22.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
6ac062d21f08f139d9f3d1e335e72e22.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
6db9f96b1c56bcb56bc88904683465da.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
6db9f96b1c56bcb56bc88904683465da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
71f510c40fe511bbc6296101698124cf.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
71f510c40fe511bbc6296101698124cf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
74e40db78ff482c904336c92e5702683.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
74e40db78ff482c904336c92e5702683.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
8245c3b357c4dfcce7e058464c58c5fe.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
8245c3b357c4dfcce7e058464c58c5fe.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
99829d5483ef57c05af928322bd5d6fd.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
99829d5483ef57c05af928322bd5d6fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
9d07b89cd606bf2379ecc25fd4a4667e.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
9d07b89cd606bf2379ecc25fd4a4667e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
b8665cf00d32352ee83ceb189595a753.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
b8665cf00d32352ee83ceb189595a753.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ce7606cfdfc05f9d4b336df2c78a46c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
ce7606cfdfc05f9d4b336df2c78a46c3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
da4a56f9db3ccef32e88ad2e5c616a1a.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
da4a56f9db3ccef32e88ad2e5c616a1a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
f1ee32e471a4581b7274c00459397cc2.exe
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
f1ee32e471a4581b7274c00459397cc2.exe
Resource
win10v2004-20240508-en
General
-
Target
da4a56f9db3ccef32e88ad2e5c616a1a.exe
-
Size
99KB
-
MD5
da4a56f9db3ccef32e88ad2e5c616a1a
-
SHA1
8a6379a31a9d80614fbcb05dbbc454aec169b114
-
SHA256
00a857cd58005ee7f9aaa14d28852b66e833375bc18f7329f955a36d271ebdee
-
SHA512
2d61ebb6c2c4ef87ac9bcab3558179b58ecf2e24011841876f55765023069eb48055e5b52d007bb681658a7fcc669b24bebe31a5bf91e42366f265ae1e6bead2
-
SSDEEP
1536:RDCxOjokD33SiCTjvEmalf++kz2u3IT7lX6Z+Hnsi73nC:p4CdDSi+Emj+vusNsi73nC
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3008 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\eobrweuy\ImagePath = "C:\\Windows\\SysWOW64\\eobrweuy\\zpvopxnw.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
da4a56f9db3ccef32e88ad2e5c616a1a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation da4a56f9db3ccef32e88ad2e5c616a1a.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3172 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
zpvopxnw.exepid process 2932 zpvopxnw.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zpvopxnw.exedescription pid process target process PID 2932 set thread context of 3172 2932 zpvopxnw.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2236 sc.exe 2800 sc.exe 5076 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
da4a56f9db3ccef32e88ad2e5c616a1a.exezpvopxnw.exedescription pid process target process PID 4484 wrote to memory of 224 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 224 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 224 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 4320 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 4320 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 4320 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe cmd.exe PID 4484 wrote to memory of 2236 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 2236 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 2236 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 2800 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 2800 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 2800 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 5076 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 5076 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 4484 wrote to memory of 5076 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe sc.exe PID 2932 wrote to memory of 3172 2932 zpvopxnw.exe svchost.exe PID 2932 wrote to memory of 3172 2932 zpvopxnw.exe svchost.exe PID 2932 wrote to memory of 3172 2932 zpvopxnw.exe svchost.exe PID 2932 wrote to memory of 3172 2932 zpvopxnw.exe svchost.exe PID 2932 wrote to memory of 3172 2932 zpvopxnw.exe svchost.exe PID 4484 wrote to memory of 3008 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe netsh.exe PID 4484 wrote to memory of 3008 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe netsh.exe PID 4484 wrote to memory of 3008 4484 da4a56f9db3ccef32e88ad2e5c616a1a.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da4a56f9db3ccef32e88ad2e5c616a1a.exe"C:\Users\Admin\AppData\Local\Temp\da4a56f9db3ccef32e88ad2e5c616a1a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eobrweuy\2⤵PID:224
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zpvopxnw.exe" C:\Windows\SysWOW64\eobrweuy\2⤵PID:4320
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create eobrweuy binPath= "C:\Windows\SysWOW64\eobrweuy\zpvopxnw.exe /d\"C:\Users\Admin\AppData\Local\Temp\da4a56f9db3ccef32e88ad2e5c616a1a.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2236 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description eobrweuy "wifi internet conection"2⤵
- Launches sc.exe
PID:2800 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eobrweuy2⤵
- Launches sc.exe
PID:5076 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:3008
-
C:\Windows\SysWOW64\eobrweuy\zpvopxnw.exeC:\Windows\SysWOW64\eobrweuy\zpvopxnw.exe /d"C:\Users\Admin\AppData\Local\Temp\da4a56f9db3ccef32e88ad2e5c616a1a.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:3172
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zpvopxnw.exeFilesize
11.7MB
MD5032b5ed04427abe3c545c56b0f780db9
SHA155ab49a05d8384f65c23a4a1a2936ba0c3e3c976
SHA2563171adefea2256bf369e21d74a0c7b4338ca39597aff8ca13400b950ac5f9760
SHA512af48426ed36fb9d5c19c0d7b4c415ec1efb783e5b2899303691c86915fdb93db1b34287a87dfac0b749a8fcce46d0271093d12bc3f13ec205d9ce121954c10fc
-
memory/2932-6-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2932-9-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2932-7-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/3172-8-0x00000000008F0000-0x0000000000905000-memory.dmpFilesize
84KB
-
memory/3172-12-0x00000000008F0000-0x0000000000905000-memory.dmpFilesize
84KB
-
memory/3172-14-0x00000000008F0000-0x0000000000905000-memory.dmpFilesize
84KB
-
memory/3172-15-0x00000000008F0000-0x0000000000905000-memory.dmpFilesize
84KB
-
memory/3172-16-0x00000000008F0000-0x0000000000905000-memory.dmpFilesize
84KB
-
memory/4484-2-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/4484-0-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/4484-1-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4484-13-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB