e7579f40e1a8f43b9d2114b022cec4e497be4dbc03c5df91c493b7a1cb23109f

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e61d3f1eedc9899e796ba56fc7bd29a8.exe
Size 1.8MB
Sample221105-krk38ahaer
SHA256 e7579f40e1a8f43b9d2114b022cec4e497be4dbc03c5df91c493b7a1cb23109f
MD5 e61d3f1eedc9899e796ba56fc7bd29a8
SHA1 f7210ba593e9cb7716a328bbcf3fe25c1b0758d7
SHA512 64396835f2f42d5226289f87896224c6a3af3f6f07edba87f0c9f9371a87c72954b24e434643d8a8f6f20a2d1d4fb5a9dccd71114630c398a86f075915bc6d07
SSDEEP 49152:EuWxdLnW8zMdao18Kwv/82sLl0WS9Nkuv:EuW7Wfk6LDeD9Nn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	e61d3f1eedc9899e796ba56fc7bd29a8.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	rundll32.exe
1752	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	e61d3f1eedc9899e796ba56fc7bd29a8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2440	4652	e61d3f1eedc9899e796ba56fc7bd29a8.exe	80
PID 4652 wrote to memory of 2440	4652	e61d3f1eedc9899e796ba56fc7bd29a8.exe	80
PID 4652 wrote to memory of 2440	4652	e61d3f1eedc9899e796ba56fc7bd29a8.exe	80
PID 2440 wrote to memory of 1768	2440	control.exe	82
PID 2440 wrote to memory of 1768	2440	control.exe	82
PID 2440 wrote to memory of 1768	2440	control.exe	82
PID 1768 wrote to memory of 2548	1768	rundll32.exe	89
PID 1768 wrote to memory of 2548	1768	rundll32.exe	89
PID 2548 wrote to memory of 1752	2548	RunDll32.exe	90
PID 2548 wrote to memory of 1752	2548	RunDll32.exe	90
PID 2548 wrote to memory of 1752	2548	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\e61d3f1eedc9899e796ba56fc7bd29a8.exe
"C:\Users\Admin\AppData\Local\Temp\e61d3f1eedc9899e796ba56fc7bd29a8.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\QDYI.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\QDYI.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\QDYI.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\QDYI.CPL",
        5⤵
        Loads dropped DLL
        
        PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QDYI.CPL

Path C:\Users\Admin\AppData\Local\Temp\QDYI.CPL
Size 1.5MB
SHA256 df8ab297b7ea9046b1050702fe6d4f1a6f1922402dafc1d263ad1f16dc476735
MD5 3a4a216aa4139329f166c4623b2cd6f0
SHA1 025491b76dff51060d8474e4bcbbb01fcf33891c
SHA512 bc609e3ed28374e7231f09ca1007247860c892429a287c075ab51fe5e836f29333b17c3d6696fe563169d0a6d9803b178ca5f530a838ce0b97713a824c2a54a4
SSDEEP 24576:wRHTuCl89jxZrv6YjM/xPImjLjif/tGqDUnvq0mgsqINOG:iu089bTc/xv2HtGqDUs9qIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

QDYI.cpl

Path C:\Users\Admin\AppData\Local\Temp\QDYI.cpl
Size 1.5MB
SHA256 df8ab297b7ea9046b1050702fe6d4f1a6f1922402dafc1d263ad1f16dc476735
MD5 3a4a216aa4139329f166c4623b2cd6f0
SHA1 025491b76dff51060d8474e4bcbbb01fcf33891c
SHA512 bc609e3ed28374e7231f09ca1007247860c892429a287c075ab51fe5e836f29333b17c3d6696fe563169d0a6d9803b178ca5f530a838ce0b97713a824c2a54a4
SSDEEP 24576:wRHTuCl89jxZrv6YjM/xPImjLjif/tGqDUnvq0mgsqINOG:iu089bTc/xv2HtGqDUs9qIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

QDYI.cpl

Path C:\Users\Admin\AppData\Local\Temp\QDYI.cpl
Size 1.5MB
SHA256 df8ab297b7ea9046b1050702fe6d4f1a6f1922402dafc1d263ad1f16dc476735
MD5 3a4a216aa4139329f166c4623b2cd6f0
SHA1 025491b76dff51060d8474e4bcbbb01fcf33891c
SHA512 bc609e3ed28374e7231f09ca1007247860c892429a287c075ab51fe5e836f29333b17c3d6696fe563169d0a6d9803b178ca5f530a838ce0b97713a824c2a54a4
SSDEEP 24576:wRHTuCl89jxZrv6YjM/xPImjLjif/tGqDUnvq0mgsqINOG:iu089bTc/xv2HtGqDUs9qIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1752-151-0x00000000033B0000-0x00000000034E6000-memory.dmp

Download

memory/1752-148-0x00000000035C0000-0x0000000003675000-memory.dmp

Download

memory/1752-147-0x00000000034F0000-0x00000000035BA000-memory.dmp

Download

memory/1752-145-0x0000000003130000-0x0000000003266000-memory.dmp

Download

memory/1752-146-0x00000000033B0000-0x00000000034E6000-memory.dmp

Download

memory/1768-137-0x0000000002E70000-0x0000000002FA6000-memory.dmp

Download

memory/1768-139-0x0000000003080000-0x0000000003135000-memory.dmp

Download

memory/1768-138-0x0000000002FB0000-0x000000000307A000-memory.dmp

Download

memory/1768-136-0x0000000002BF0000-0x0000000002D26000-memory.dmp

Download

memory/1768-152-0x0000000002E70000-0x0000000002FA6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads