87fdf41f3af47dc20348fe21148546a943111c455ffb9a8cd73b1beb77513ce4

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2022, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-Belge1.exe
Size 1.1MB
Sample220928-hel4msfbg8
SHA256 87fdf41f3af47dc20348fe21148546a943111c455ffb9a8cd73b1beb77513ce4
MD5 93806db4549578ef1cb21b7f688798b2
SHA1 12e313f0998ab9010ca7e23f85da6f98f8b02030
SHA512 443c96b19426abde09f5f7006c77cc3ac5660200d0480eca898e724e27d2d03771774eab318f294295165bbb4d72cd43a5fc748af0f92371e865f5108f48d8da
SSDEEP 24576:UAOcZXcxP6+jn2sKlQT/zeRoCR3lBR4YaGAuvZG31RMaas/xqY:CHUez8bkQA3XM9c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4872	tjlxrq.pif

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	e-Belge1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 3964	4872	tjlxrq.pif	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
212	3964	WerFault.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4872	3016	e-Belge1.exe	80
PID 3016 wrote to memory of 4872	3016	e-Belge1.exe	80
PID 3016 wrote to memory of 4872	3016	e-Belge1.exe	80
PID 4872 wrote to memory of 664	4872	tjlxrq.pif	85
PID 4872 wrote to memory of 664	4872	tjlxrq.pif	85
PID 4872 wrote to memory of 664	4872	tjlxrq.pif	85
PID 4872 wrote to memory of 3964	4872	tjlxrq.pif	86
PID 4872 wrote to memory of 3964	4872	tjlxrq.pif	86
PID 4872 wrote to memory of 3964	4872	tjlxrq.pif	86
PID 4872 wrote to memory of 3964	4872	tjlxrq.pif	86

C:\Users\Admin\AppData\Local\Temp\e-Belge1.exe
"C:\Users\Admin\AppData\Local\Temp\e-Belge1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Roaming\5_17\tjlxrq.pif
  "C:\Users\Admin\AppData\Roaming\5_17\tjlxrq.pif" xeaawehrpe.sbo
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 80
      4⤵
      Program crash
      PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3964 -ip 3964
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ibkondar.cpl

Path C:\Users\Admin\AppData\Roaming\5_17\ibkondar.cpl
Size 38KB
SHA256 11a9097e0c6e23299763487ff98036f0a6a9ec706344ce22962ab7f350141165
MD5 1c18f14fdd445534f700057f9f26882c
SHA1 d9d3d3ea982acaa128cf964378dfac65f09a09b0
SHA512 54db999e73eb51ce2bd2cebbfed22fcc8b88c42ddf15f5569737e7706896cdedfee4996c5d30921a424b59873b42b461dd740d8667d848b63e00e6bf899f2184
SSDEEP 768:YSPpcvtv02NXKOguRt77cqRS/OSSJT2Jrz/E7bhBpWROk:jgdNXoun779g/OSOKJnihBrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjlxrq.pif

Path C:\Users\Admin\AppData\Roaming\5_17\tjlxrq.pif
Size 794KB
SHA256 e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
MD5 18e404787e9c044105f5c4bec4600bd8
SHA1 9f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA512 c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
SSDEEP 24576:ucneJVBvXAvwRJdwvZ5aiCmdDSnI5DGR2:nenBvXA4DAZ5a9mNSc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjlxrq.pif

Path C:\Users\Admin\AppData\Roaming\5_17\tjlxrq.pif
Size 794KB
SHA256 e15984dc8ea9627d370c40178676490129427e2dc23499f68c9c65c4386fea12
MD5 18e404787e9c044105f5c4bec4600bd8
SHA1 9f1015bd7f33a6f3c1cc12c0971f51b1adee1939
SHA512 c6a1faae524968351b4841665bfe1c5255f7e6c115b7a81a4b6c65626f23f7f15e4bb856914fce15225c33a2e2b6166b3f1f87698895fe0ce4cb084b630c2a5f
SSDEEP 24576:ucneJVBvXAvwRJdwvZ5aiCmdDSnI5DGR2:nenBvXA4DAZ5a9mNSc1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjrwlpjd.asm

Path C:\Users\Admin\AppData\Roaming\5_17\vjrwlpjd.asm
Size 371KB
SHA256 69060028cbe4111dd9abf7b51390a3edd0669fcd5e804be0917ea95aedae5250
MD5 7def8b74316279546efc1e1937d2aef7
SHA1 5a85b867dcbeedb83cfec2848d2b4fda149a2fca
SHA512 a7129ee457e223ba3c93f6ce873906ea81cb23aab26e4dbd816daa2163e30487eaf8bf7040ff1a489c111c99632b2d22dff4f30871b9f010baa19e18e566e356
SSDEEP 6144:uREUzVAojCDBG4TwsiRDlF/U/kgORioB13:uOGjj2DTkR5jEoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

xeaawehrpe.sbo

Path C:\Users\Admin\AppData\Roaming\5_17\xeaawehrpe.sbo
Size 177.8MB
SHA256 cd8ada65644a210621c39aa5e4097e829e405575c743a799ffab10ff6f2dceca
MD5 119095e96ce0d1f51c35dd67ec2b5706
SHA1 7088de971881b64ac1cfcfefbda425213fa4bbbc
SHA512 d99457332d8afbc12b2a1e640bf436701c721e3947db2cc77e4c4bd7f8872ec52617f6fa04ce20f8599bc181f5d424f501fb0d5c14c90543d3687c5c2c55c621
SSDEEP 49152:xNhBgqkVN0tFz0UyYMZiOz3o8/bq1O9sztpRAyIVRVChqwvnS/cDeHojXyGJSeoi:P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads