fdb421f4a654a5c34a0ac53fe5b8034076d294c846f6df5c645ca102b6f4caf0

General

Target

5238fc6bf3af2fc3b88d102c4f4cf99d.exe
Size

5.5MB
MD5

5238fc6bf3af2fc3b88d102c4f4cf99d
SHA1

7c53d7e2294b99d13987207e6649679239c1b7db
SHA256

fdb421f4a654a5c34a0ac53fe5b8034076d294c846f6df5c645ca102b6f4caf0
SHA512

15ced287df98da57549848983785925c18fadd2bd5033afe26c1b95a811f3f51bfd09da80ef8c829cb061d240cc21ef936d0105f72ca0afb7427b172026dfd96
SSDEEP

98304:0kLbDnTP0AenE1XFbFqvb9/vJtkh7dAy9QdB4BC+4fo8os9YYHo9ty55lji:DbzTP0ZEdwbV50aB4hjYIjkn+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4880	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Loads dropped DLL 2 IoCs

pid	Process
4880	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	217.160.70.42

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 1388	628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	85

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PC_installer\unins000.dat	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
File created	C:\Program Files (x86)\PC_installer\is-9TQJ0.tmp	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4880	4780	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	82
PID 4780 wrote to memory of 4880	4780	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	82
PID 4780 wrote to memory of 4880	4780	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	82
PID 4880 wrote to memory of 1524	4880	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	83
PID 4880 wrote to memory of 1524	4880	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	83
PID 4880 wrote to memory of 1524	4880	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	83
PID 1524 wrote to memory of 628	1524	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	84
PID 1524 wrote to memory of 628	1524	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	84
PID 1524 wrote to memory of 628	1524	5238fc6bf3af2fc3b88d102c4f4cf99d.exe	84
PID 628 wrote to memory of 1388	628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	85
PID 628 wrote to memory of 1388	628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	85
PID 628 wrote to memory of 1388	628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	85
PID 628 wrote to memory of 1388	628	5238fc6bf3af2fc3b88d102c4f4cf99d.tmp	85

C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe
"C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$9007C,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe
    "C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp" /SL5="$B0046,4926658,832512,C:\Users\Admin\AppData\Local\Temp\5238fc6bf3af2fc3b88d102c4f4cf99d.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9T5TS.tmp\valom.dll

Filesize
284KB

MD5
da1d7a4aa733808a325c1f391fcb929d

SHA1
d1c897aaf9dd98e485ea3ecae824df6c44a56b52

SHA256
04900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542

SHA512
9a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R675E.tmp\valom.dll

Filesize
284KB

MD5
da1d7a4aa733808a325c1f391fcb929d

SHA1
d1c897aaf9dd98e485ea3ecae824df6c44a56b52

SHA256
04900720fee885508357a6149de6905cf9e077baaede0eb54301ec33c243e542

SHA512
9a58395b31441ab29e56688f488911c9dba50eaf9fbf03b6d012c648e5436f4643148a03a26aa14e5789af78ca4e0ac9c4de7c9981136517b356c69581d79682

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Filesize
3.0MB

MD5
a2c2a94b03a9313cc500f34e8e888814

SHA1
7d9bb44259d6eca9e6d77dbf92919ea17271e418

SHA256
4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

SHA512
d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TMA28.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Filesize
3.0MB

MD5
a2c2a94b03a9313cc500f34e8e888814

SHA1
7d9bb44259d6eca9e6d77dbf92919ea17271e418

SHA256
4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

SHA512
d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VHSGR.tmp\5238fc6bf3af2fc3b88d102c4f4cf99d.tmp

Filesize
3.0MB

MD5
a2c2a94b03a9313cc500f34e8e888814

SHA1
7d9bb44259d6eca9e6d77dbf92919ea17271e418

SHA256
4c9c6946f0ef4762738534176978db1ad3b8b90ad4f247bc77fc389550f0fa3d

SHA512
d5fde5abf118d79c77e406cf33c8ab69d88ad1bfae5be953a6a211654ede90bccd0fc5ef67d566bc38b31889065dec26436a834f5ec1bde0b60cb91bcbbe336d

Download Submit
memory/628-149-0x00000000034D0000-0x00000000034F7000-memory.dmp

Filesize
156KB

Download
memory/1388-146-0x0000000000B80000-0x0000000000BAC000-memory.dmp

Filesize
176KB

Download
memory/1388-152-0x0000000000B80000-0x0000000000BAC000-memory.dmp

Filesize
176KB

Download
memory/1388-150-0x0000000000B80000-0x0000000000BAC000-memory.dmp

Filesize
176KB

Download
memory/1388-148-0x0000000000B80000-0x0000000000BAC000-memory.dmp

Filesize
176KB

Download
memory/1388-147-0x0000000000B80000-0x0000000000BAC000-memory.dmp

Filesize
176KB

Download
memory/1524-139-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1524-153-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4780-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4780-132-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4780-141-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing