63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe
Size

124KB
MD5

90b8d5eb95f0f3b00551366bc0a507e0
SHA1

f76e663d9e13f9a61e053d5c0ceae307e6172bc9
SHA256

63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2
SHA512

d4c0d2f10a98b2d68d7096166b1e5b4a015c42efc596fab6f3a2235f15472e721d80bad1217ad1ab7ccfb364ed9d86bc0f923877b08f9e2a5f8455ced81c7742
SSDEEP

768:/Sa6eQl0SrLwoWdcsjdTZG02JFDiB9y3s6vHihJoYho+NfFqM8PLv8bHxO6pVIs:/Sa45ccsjh802hrvOov+JwvPuHxO6V

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2140	kexzamet.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2140	4244	63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe	85
PID 4244 wrote to memory of 2140	4244	63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe	85
PID 4244 wrote to memory of 2140	4244	63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe	85

C:\Users\Admin\AppData\Local\Temp\63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe
"C:\Users\Admin\AppData\Local\Temp\63b50a27b00055d448ea447bce689b3df4e9a90a9e51f1f9f85c4f589e9a4ee2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\kexzamet.exe
  "C:\Users\Admin\AppData\Local\Temp\kexzamet.exe"
  2⤵
  - Executes dropped EXE
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kexzamet.exe

Filesize
124KB

MD5
7eab32921a0dd81323f5b5a14df193e1

SHA1
0c706812d8f5768496bdc16e18cc7e1b56c1afe8

SHA256
e0dd09a5326f8d9a82886a092c3d1ac4dfe73a48bb96d24556600dbe51787fdc

SHA512
cadae962bcf5d32051131180baf108ff2666c389d734a8a5660dca25ec2c64e423113eaf7a7d3931b7ca5ba0c3cbce08a36741aeb6f2607d1fb39f038aa92d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kexzamet.exe

Filesize
124KB

MD5
7eab32921a0dd81323f5b5a14df193e1

SHA1
0c706812d8f5768496bdc16e18cc7e1b56c1afe8

SHA256
e0dd09a5326f8d9a82886a092c3d1ac4dfe73a48bb96d24556600dbe51787fdc

SHA512
cadae962bcf5d32051131180baf108ff2666c389d734a8a5660dca25ec2c64e423113eaf7a7d3931b7ca5ba0c3cbce08a36741aeb6f2607d1fb39f038aa92d2e

Download Submit
memory/2140-136-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4244-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download