5015af8fb5725c4c9ebac28a890128587b888acddab6cc9ff06e94e782713882

Analysis

max time kernel
292s
max time network
264s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

svhost.exe
Size

350KB
MD5

6fb915548ae2ce60326488761dedbe62
SHA1

cd2f503b3194f1e0987f7cfee123ffc323dbe5c1
SHA256

3594a403aca3195c3e9b74f95669e33548a06bfaccf6e9bc02b86767d38d214e
SHA512

51ee2953cb70a3b0ae344cc274381adebf77fc249732189c77d1e8dc8682040ad0ae6faf850a40af58fa63a13b0e75286562204e40f02da480e5444047095828
SSDEEP

6144:R19M6S33QFnHZxkcdaGB/D2IlV2qDClJL3tcTzQzerIaQTt7HYRh4E7kYFIhVF38:r9pSHKHZxkMBL2IlnYa18aOt74Ry+qhc

Score

10^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe, C:\\Program Files\\Common Files\\qip\\svhost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe, C:\\Program Files\\Common Files\\qip\\svhost.exe"	reg.exe

Executes dropped EXE 2 IoCs

Processes:

1.exenetprotocol.exe

pid process

2692 1.exe
2828 netprotocol.exe
Loads dropped DLL 4 IoCs

Processes:

cmd.exe1.exe

pid process

2808 cmd.exe
2808 cmd.exe
2692 1.exe
2692 1.exe

pid	process
2692	1.exe
2828	netprotocol.exe

pid	process
2808	cmd.exe
2808	cmd.exe
2692	1.exe
2692	1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	1.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.execmd.exe

pid process

2616 cmd.exe
2628 cmd.exe

pid	process
2616	cmd.exe
2628	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\1.exe	upx
behavioral24/memory/2808-8-0x0000000000120000-0x000000000015A000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\netprotocol.exe	upx

Drops file in Program Files directory 2 IoCs

Processes:

attrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\qip	attrib.exe
File opened for modification	C:\Program Files\Common Files\qip\svhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exe1.execmd.execmd.execmd.exeattrib.exesvhost.execmd.exereg.exereg.exeattrib.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

2728 cmd.exe

pid	process
2728	cmd.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

svhost.execmd.exe1.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1748 wrote to memory of 2808	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2808	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2808	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2808	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2728	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2728	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2728	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2728	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2168	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2168	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2168	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2168	1748	svhost.exe	cmd.exe
PID 2808 wrote to memory of 2692	2808	cmd.exe	1.exe
PID 2808 wrote to memory of 2692	2808	cmd.exe	1.exe
PID 2808 wrote to memory of 2692	2808	cmd.exe	1.exe
PID 2808 wrote to memory of 2692	2808	cmd.exe	1.exe
PID 1748 wrote to memory of 2604	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2604	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2604	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2604	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2616	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2616	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2616	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2616	1748	svhost.exe	cmd.exe
PID 2692 wrote to memory of 2828	2692	1.exe	netprotocol.exe
PID 2692 wrote to memory of 2828	2692	1.exe	netprotocol.exe
PID 2692 wrote to memory of 2828	2692	1.exe	netprotocol.exe
PID 2692 wrote to memory of 2828	2692	1.exe	netprotocol.exe
PID 1748 wrote to memory of 2628	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2628	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2628	1748	svhost.exe	cmd.exe
PID 1748 wrote to memory of 2628	1748	svhost.exe	cmd.exe
PID 2168 wrote to memory of 376	2168	cmd.exe	reg.exe
PID 2168 wrote to memory of 376	2168	cmd.exe	reg.exe
PID 2168 wrote to memory of 376	2168	cmd.exe	reg.exe
PID 2168 wrote to memory of 376	2168	cmd.exe	reg.exe
PID 2604 wrote to memory of 844	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 844	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 844	2604	cmd.exe	reg.exe
PID 2604 wrote to memory of 844	2604	cmd.exe	reg.exe
PID 2628 wrote to memory of 264	2628	cmd.exe	attrib.exe
PID 2628 wrote to memory of 264	2628	cmd.exe	attrib.exe
PID 2628 wrote to memory of 264	2628	cmd.exe	attrib.exe
PID 2628 wrote to memory of 264	2628	cmd.exe	attrib.exe
PID 2616 wrote to memory of 572	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 572	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 572	2616	cmd.exe	attrib.exe
PID 2616 wrote to memory of 572	2616	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

572 attrib.exe
264 attrib.exe

pid	process
572	attrib.exe
264	attrib.exe

C:\Users\Admin\AppData\Local\Temp\svhost.exe
"C:\Users\Admin\AppData\Local\Temp\svhost.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\1.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\1.exe
    C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move /y "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\svhost.exe" "C:\Program Files\Common Files\qip\svhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v shell /t reg_sz /d "Explorer.exe, C:\Program Files\Common Files\qip\svhost.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon" /v shell /t reg_sz /d "Explorer.exe, C:\Program Files\Common Files\qip\svhost.exe" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon " /v shell /t reg_sz /d "Explorer.exe, C:\Program Files\Common Files\qip\svhost.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\reg.exe
    reg add "hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon " /v shell /t reg_sz /d "Explorer.exe, C:\Program Files\Common Files\qip\svhost.exe" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Program Files\Common Files\qip\svhost.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Program Files\Common Files\qip\svhost.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Program Files\Common Files\qip"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Program Files\Common Files\qip"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\1.exe

Filesize
80KB

MD5
7f550991510e8dd336b4321d719279b7

SHA1
3070f320a8f184ab1193dfc8cbfde6d5f91964c3

SHA256
905246be7f2ac87e583b541364513dd82a10e4751c615e6490ab80be6825f48c

SHA512
d0b6bad92cf6d6f8a98f0f343fdc6cb6b5a1e38c0fffa4b7209e0f3677aec8ddb8d678b55c3273aa59f9924353337a898dc74d85663321cda755ff36f9f0f858

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
80KB

MD5
c6e74cb0d7e7360d2815233db46955c8

SHA1
02564a38bdac76485b63733636df50038f2b46c0

SHA256
b707cc9a8f323a32054401eb2e41dc88f49c727956cddb1f540793ba896cc41e

SHA512
2ef09cecec6313a5ee8b2023bb6cc2e812dd2ff7c670d2c9f7e75576f53c987cf115b84f8e2795429d431168b1c232acbea61afe00b47ed488cf03ecd9481487

Download Submit
memory/1748-1-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1748-0-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1748-24-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2692-21-0x0000000000270000-0x00000000002AA000-memory.dmp

Filesize
232KB

Download
memory/2692-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2692-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2808-12-0x0000000000120000-0x000000000015A000-memory.dmp

Filesize
232KB

Download
memory/2808-8-0x0000000000120000-0x000000000015A000-memory.dmp

Filesize
232KB

Download
memory/2808-25-0x0000000000120000-0x000000000015A000-memory.dmp

Filesize
232KB

Download
memory/2828-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2828-27-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download