477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279

General

Target

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe
Size

220KB
MD5

3829791a486b0b9ccb80ffcb7177c19c
SHA1

63b775ca11d595d65b8dfa4215823e7cb98c55af
SHA256

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279
SHA512

f1d6950caf18ae7b3f68c6cecded468a706a08ec6a33d6ea29d21f6d120badcb020ae89a3c0be2fadd64424cc931724dbda3b0bd0c4b23f161ab86bde57b4d66

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

athvindaur.exe

pid	Process
2008	athvindaur.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

pid	Process
2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe
2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe
2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

description	pid	Process
Token: SeDebugPrivilege	2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe

description	pid	Process	procid_target
PID 2940 wrote to memory of 2008	2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe	81
PID 2940 wrote to memory of 2008	2940	477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe	81

C:\Users\Admin\AppData\Local\Temp\477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe
"C:\Users\Admin\AppData\Local\Temp\477147271a54e32ef184030393f17c30d68d4aeb8bd6202a225e354f1800b279.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\ProgramData\Paints\athvindaur.exe
  "C:\ProgramData\Paints\athvindaur.exe"
  2⤵
  - Executes dropped EXE
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Paints\athvindaur.exe

Filesize
6.3MB

MD5
faa80dfb1c0091ba3e69bee529d6bd3a

SHA1
90697c8f4d5bbab6b525c15c74cadd2bf7332b5c

SHA256
ec15d79602c7d0ef5b4a9fcfce758e431a3d8d307a9267788a26fb908f7450ba

SHA512
a49b0b586bad720b23de187907b0714558d7dedd5a7710ae594ba17677d2b31d61893c2daea6e824fe238cba1e65c179f5f8b96934bc75b551b3ceaeaa90ac5d

Download Submit
C:\ProgramData\Paints\athvindaur.exe

Filesize
5.1MB

MD5
996dabaa85648accf1054213a6060be0

SHA1
4879f81fa1ec7a6fccb77db7b360e44003031ec3

SHA256
f357b2d7aa0645d597cf3c9b41b16c6d92c024001fe04d40bb4678e12e16d804

SHA512
8485c344d321a84a44a78aee7d2e98023fd405ccdf9412bc26f03b7c66885316da48c45d3e15582997284c60fe9b21d74d10ab4ddd023dbbb2afc1390ec23384

Download Submit
memory/2008-132-0x0000000000000000-mapping.dmp

Download
memory/2008-135-0x000001DD845C0000-0x000001DD8504E000-memory.dmp

Filesize
10.6MB

Download
memory/2940-130-0x00000000010C0000-0x00000000010C2000-memory.dmp

Filesize
8KB

Download
memory/2940-131-0x00000000010C2000-0x00000000010C4000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads