8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec

General

Target

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
Size

223KB
MD5

8efdbfe8c5cb0cacaca53e190caca052
SHA1

74961a5b6cdc720b39ba613da403fe6ffd44c2ec
SHA256

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec
SHA512

fb39103cc20b3ef7e461152ac5cfcedf91c39d3e7f8132496cb836560d95a347c353e8050e1fbcad190a691fc8e5a4f1fa6ba7f626c869ccb9864725bdb1bb88

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rlxbfw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Lhgvysi\\Rlxbfw.exe\""	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

powershell.exe8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

pid	process
2020	powershell.exe
2020	powershell.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe

description	pid	process	target process
PID 1148 wrote to memory of 2020	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	powershell.exe
PID 1148 wrote to memory of 2020	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	powershell.exe
PID 1148 wrote to memory of 4000	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 4000	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 640	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 640	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 1948	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 1948	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 3128	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 3128	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 1068	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 1068	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2096	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2096	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2312	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2312	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2104	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2104	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 3900	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 3900	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2316	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe
PID 1148 wrote to memory of 2316	1148	8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe
"C:\Users\Admin\AppData\Local\Temp\8d687ad5eaee819a0288bf65c8139a35679339c404ac589494caecd69beef0ec.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA0AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:4000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:640

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:1948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:3128

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:1068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:2096

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
2⤵
PID:2316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-130-0x00000246EC3D0000-0x00000246EC40C000-memory.dmp

Filesize
240KB

Download
memory/1148-131-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download
memory/1148-132-0x00000246EDF90000-0x00000246EDFB2000-memory.dmp

Filesize
136KB

Download
memory/1148-135-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download
memory/1148-138-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download
memory/2020-133-0x0000000000000000-mapping.dmp

Download
memory/2020-134-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download
memory/2020-136-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download
memory/2020-137-0x00007FFF73D50000-0x00007FFF74811000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads