Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
0abc4b358f37c9c49835ccd3adec2130N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0abc4b358f37c9c49835ccd3adec2130N.exe
Resource
win10v2004-20240709-en
General
-
Target
0abc4b358f37c9c49835ccd3adec2130N.exe
-
Size
144KB
-
MD5
0abc4b358f37c9c49835ccd3adec2130
-
SHA1
3996477c3a5262fa442285319bc7e53c9b6c999d
-
SHA256
fa516e81e02c453789dec877af057772b5e8b5ff97e3621b3b38065aa18914a9
-
SHA512
904ed1c87a1be42455370329aec2f71ccff6d4dc4847b64f692ff11e509692c89d0655c935b4c02dc5b6afec2eaa192abd7f38e830c9e6200e7f5eb424105e6f
-
SSDEEP
1536:2ai8yRlkj5a9rNzJLGDNGrNesEfL8St26Jsvf+HI5Qlr6pVX:URlm0WDc55qL8Sg6Ji+HEQlrSR
Malware Config
Extracted
tofsee
103.246.115.238
188.190.120.102
112.213.106.187
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0abc4b358f37c9c49835ccd3adec2130N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 0abc4b358f37c9c49835ccd3adec2130N.exe -
Executes dropped EXE 2 IoCs
Processes:
efxvvphu.exeefxvvphu.exepid process 1688 efxvvphu.exe 772 efxvvphu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0abc4b358f37c9c49835ccd3adec2130N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\efxvvphu.exe\"" 0abc4b358f37c9c49835ccd3adec2130N.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0abc4b358f37c9c49835ccd3adec2130N.exeefxvvphu.exeefxvvphu.exedescription pid process target process PID 4628 set thread context of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 1688 set thread context of 772 1688 efxvvphu.exe efxvvphu.exe PID 772 set thread context of 4024 772 efxvvphu.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 3840 4024 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0abc4b358f37c9c49835ccd3adec2130N.exeefxvvphu.exepid process 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 1688 efxvvphu.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
0abc4b358f37c9c49835ccd3adec2130N.exe0abc4b358f37c9c49835ccd3adec2130N.exeefxvvphu.exeefxvvphu.exedescription pid process target process PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 4628 wrote to memory of 3528 4628 0abc4b358f37c9c49835ccd3adec2130N.exe 0abc4b358f37c9c49835ccd3adec2130N.exe PID 3528 wrote to memory of 1688 3528 0abc4b358f37c9c49835ccd3adec2130N.exe efxvvphu.exe PID 3528 wrote to memory of 1688 3528 0abc4b358f37c9c49835ccd3adec2130N.exe efxvvphu.exe PID 3528 wrote to memory of 1688 3528 0abc4b358f37c9c49835ccd3adec2130N.exe efxvvphu.exe PID 3528 wrote to memory of 1224 3528 0abc4b358f37c9c49835ccd3adec2130N.exe cmd.exe PID 3528 wrote to memory of 1224 3528 0abc4b358f37c9c49835ccd3adec2130N.exe cmd.exe PID 3528 wrote to memory of 1224 3528 0abc4b358f37c9c49835ccd3adec2130N.exe cmd.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 1688 wrote to memory of 772 1688 efxvvphu.exe efxvvphu.exe PID 772 wrote to memory of 4024 772 efxvvphu.exe svchost.exe PID 772 wrote to memory of 4024 772 efxvvphu.exe svchost.exe PID 772 wrote to memory of 4024 772 efxvvphu.exe svchost.exe PID 772 wrote to memory of 4024 772 efxvvphu.exe svchost.exe PID 772 wrote to memory of 4024 772 efxvvphu.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0abc4b358f37c9c49835ccd3adec2130N.exe"C:\Users\Admin\AppData\Local\Temp\0abc4b358f37c9c49835ccd3adec2130N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\0abc4b358f37c9c49835ccd3adec2130N.exe"C:\Users\Admin\AppData\Local\Temp\0abc4b358f37c9c49835ccd3adec2130N.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\efxvvphu.exe"C:\Users\Admin\efxvvphu.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\efxvvphu.exe"C:\Users\Admin\efxvvphu.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 3606⤵
- Program crash
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1745.bat" "3⤵PID:1224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4024 -ip 40241⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1745.batFilesize
240B
MD54e3648474be1c465e98303dd88ab7a05
SHA135afef2cf69fed4172c0019f7d26f5c91bd63ef4
SHA256a2989e8dd0871c9f2291625561e58e4cc552222caefc82f30a6af11cbec738dc
SHA5122a393d93a7b4827404d9c860e9abec0baf42fff111c08ae9360830a6b35eb9bc6ff56c10e82bc7d0160fe836fe65d9418753bc9a1ecb3a8dfdddba1ef8088423
-
C:\Users\Admin\efxvvphu.exeFilesize
44.0MB
MD56105bbf47574b1065582876acc4a2ec6
SHA106f47687cf51a1636b3462f7805414b25ca5a082
SHA25627a019b0fea09736af9ea345bc23195fef98484d4ff9e95e7bf18048f9e21c33
SHA51253c89b14b73b239c7fc093b4c02d7e5659fc9b7a5ee6d8c9d451766e68b192cf2c322a65b5a16fa3f14feac6771dffba755a7ad8ff7b2b2a34e78908f1c16762
-
memory/772-27-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1688-21-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3528-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3528-17-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3528-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3528-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4024-33-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/4024-32-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/4024-26-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/4024-37-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/4024-38-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/4024-39-0x0000000000900000-0x0000000000912000-memory.dmpFilesize
72KB
-
memory/4628-3-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB