Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe
-
Size
14.6MB
-
MD5
98fa720e04828c3150ee35c8cb30f403
-
SHA1
d5b7405bd6d33d41b06f12dc8c15dc6abe65db4a
-
SHA256
adebf698ce7862226c1794aafa272bc8bdd8363ccfb2ed52964912f89f79e61e
-
SHA512
f0d572dac42f07c94debb447ff084e523dc9e7e7d597ad789f87d0459193db6d3d1e7c20b4afb072ca7bbd54d090524e625ba5f69e30f64ed610699804c3a3b8
-
SSDEEP
6144:2+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:2+r1IeSXMXc7LlxWV4Ug97GZ+ej
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2640 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nuruohnb\ImagePath = "C:\\Windows\\SysWOW64\\nuruohnb\\ggflwkru.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1700 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
ggflwkru.exepid process 2292 ggflwkru.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ggflwkru.exedescription pid process target process PID 2292 set thread context of 1700 2292 ggflwkru.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3008 sc.exe 2692 sc.exe 2820 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exeggflwkru.exedescription pid process target process PID 1780 wrote to memory of 1952 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 1952 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 1952 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 1952 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 2804 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 2804 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 2804 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 2804 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe cmd.exe PID 1780 wrote to memory of 3008 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 3008 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 3008 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 3008 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2692 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2692 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2692 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2692 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2820 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2820 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2820 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 1780 wrote to memory of 2820 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe sc.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 2292 wrote to memory of 1700 2292 ggflwkru.exe svchost.exe PID 1780 wrote to memory of 2640 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe netsh.exe PID 1780 wrote to memory of 2640 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe netsh.exe PID 1780 wrote to memory of 2640 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe netsh.exe PID 1780 wrote to memory of 2640 1780 2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nuruohnb\2⤵PID:1952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ggflwkru.exe" C:\Windows\SysWOW64\nuruohnb\2⤵PID:2804
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nuruohnb binPath= "C:\Windows\SysWOW64\nuruohnb\ggflwkru.exe /d\"C:\Users\Admin\AppData\Local\Temp\2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3008 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nuruohnb "wifi internet conection"2⤵
- Launches sc.exe
PID:2692 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nuruohnb2⤵
- Launches sc.exe
PID:2820 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2640
-
C:\Windows\SysWOW64\nuruohnb\ggflwkru.exeC:\Windows\SysWOW64\nuruohnb\ggflwkru.exe /d"C:\Users\Admin\AppData\Local\Temp\2024-06-19_98fa720e04828c3150ee35c8cb30f403_mafia.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:1700
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.4MB
MD519d0fddfa22a4eff7f9c12246fc2b022
SHA1446ca6915baaf66115bf8794387a6c87ea359b0a
SHA256d59e3d1c05d900df232108cdf4f6ea40f455076296cac203f8e1de780d5e30b2
SHA5129efb6104938d24c3c73a6abd8d76dd1858d1c14a430152d14f56b9865b133d2631544e5115bbd8ca3ab30e6b2dbcd9754707811f832b3a270df25a8519f549f8