5a62cd8dee941e1c52a6a2ec03128a27d2ee0ecef5d2b6afe8f8012c23a2006c

Resubmissions

14/09/2022, 09:00

220914-kynspadebp8

11/09/2022, 12:55

220911-p5r6xabeh66

Analysis

max time kernel
125s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2022, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Phtoo35la0d01.exe
Size 18.9MB
Sample220914-kynspadebp
SHA256 5a62cd8dee941e1c52a6a2ec03128a27d2ee0ecef5d2b6afe8f8012c23a2006c
MD5 608914427ccfb02b7c7b7d7fce3eb008
SHA1 5d281943bd8b9664d47bb3c99a7d74e5deedcb0b
SHA512 6694d467415a0b639216bc4f5087186a6df99b7e627e2f058af2b99b09699c527ba710a803abeee8ed03742df20d0543f2c3958332f19b1dd9aa6f8927ae6dfe
SSDEEP 393216:p64wIf5pNBNdcNyWnfBPCdhjjmOCy2VseXJ2nNg9RYEz2nWcv+5fGd0WF4w:Q2f59N+MdgnVseZ2ni9RZ2n92hGZ4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4400	Phogb30fylsxn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Phtoo35la0d01.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3412	Phtoo35la0d01.exe
4400	Phogb30fylsxn.exe
4400	Phogb30fylsxn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	Phtoo35la0d01.exe
Token: SeDebugPrivilege	4400	Phogb30fylsxn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4400	3412	Phtoo35la0d01.exe	85
PID 3412 wrote to memory of 4400	3412	Phtoo35la0d01.exe	85
PID 3412 wrote to memory of 4400	3412	Phtoo35la0d01.exe	85
PID 3412 wrote to memory of 3172	3412	Phtoo35la0d01.exe	86
PID 3412 wrote to memory of 3172	3412	Phtoo35la0d01.exe	86
PID 3412 wrote to memory of 3172	3412	Phtoo35la0d01.exe	86
PID 3172 wrote to memory of 3456	3172	cmd.exe	88
PID 3172 wrote to memory of 3456	3172	cmd.exe	88
PID 3172 wrote to memory of 3456	3172	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Phtoo35la0d01.exe
"C:\Users\Admin\AppData\Local\Temp\Phtoo35la0d01.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\Phogb30fylsxn.exe
  "C:\Users\Admin\AppData\Local\Temp\Phogb30fylsxn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Phtoo35la0d01.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:3456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Phogb30fylsxn.exe

Path C:\Users\Admin\AppData\Local\Temp\Phogb30fylsxn.exe
Size 18.9MB
SHA256 98a0393a925b787f53f9f344f0fdccad7c5cdc9f34f739ffa3ac3c8e92c409ac
MD5 b6c2d90f013ac4a6821853795e63c3f5
SHA1 b895b98f433d681acf49ae6d76f9230f9e326a99
SHA512 265aacbac11d45f52525cc0d04bdf9ef89f71792e03e120b72f3bbca24426ae1d4cc5ea1b543c70f6814d725712be9f2aa169ba21561058c23947fecbdfe5e5a
SSDEEP 393216:VBaQjSBp34tQ+XyPOFzlSbvkpPK4EpfWWldL0xWqAS:/SB/+imDHpP5EpfWWlB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Phogb30fylsxn.exe

Path C:\Users\Admin\AppData\Local\Temp\Phogb30fylsxn.exe
Size 18.9MB
SHA256 98a0393a925b787f53f9f344f0fdccad7c5cdc9f34f739ffa3ac3c8e92c409ac
MD5 b6c2d90f013ac4a6821853795e63c3f5
SHA1 b895b98f433d681acf49ae6d76f9230f9e326a99
SHA512 265aacbac11d45f52525cc0d04bdf9ef89f71792e03e120b72f3bbca24426ae1d4cc5ea1b543c70f6814d725712be9f2aa169ba21561058c23947fecbdfe5e5a
SSDEEP 393216:VBaQjSBp34tQ+XyPOFzlSbvkpPK4EpfWWldL0xWqAS:/SB/+imDHpP5EpfWWlB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3412-135-0x000000000F4A0000-0x000000000F532000-memory.dmp

Download

memory/3412-136-0x000000000F400000-0x000000000F40A000-memory.dmp

Download

memory/3412-137-0x000000000F650000-0x000000000F6A6000-memory.dmp

Download

memory/3412-138-0x00000000131A0000-0x0000000013206000-memory.dmp

Download

memory/3412-132-0x0000000000A70000-0x0000000001D60000-memory.dmp

Download

memory/3412-134-0x000000000F9B0000-0x000000000FF54000-memory.dmp

Download

memory/3412-133-0x000000000F360000-0x000000000F3FC000-memory.dmp

Download

memory/4400-143-0x0000000000E10000-0x0000000002100000-memory.dmp

Download

memory/4400-145-0x0000000014F90000-0x0000000014F9A000-memory.dmp

Download

memory/4400-146-0x0000000015230000-0x0000000015242000-memory.dmp

Download