dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492

General

Target

dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe
Size

7KB
MD5

52c387d66edca29d7b059f6a0c3accd0
SHA1

50c86c919e057630aaaea56bd864f2371ca962c3
SHA256

dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492
SHA512

4e906bcae00ac2ebd930fa1335c1538a70bfac2c8c0ab3db2341b54c119c994deed0bcf02e37eecc793e0e096c4d06bb8fd19092d61e1a7f281cea07f74aff91
SSDEEP

96:pQ54+WvvTbLa7v11o+WLNqszZZ1YrI3uWaDLeBomjjP:u54+Wvvf0ro3oqgGaDLI/b

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe

Unexpected DNS network traffic destination 62 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.116.118
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205
Destination IP	85.255.112.205

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 5 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

4920 ipconfig.exe
4808 ipconfig.exe
4848 ipconfig.exe
4872 ipconfig.exe
4916 ipconfig.exe

pid	process
4920	ipconfig.exe
4808	ipconfig.exe
4848	ipconfig.exe
4872	ipconfig.exe
4916	ipconfig.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe

description	pid	process	target process
PID 3016 wrote to memory of 4848	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4848	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4848	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4872	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4872	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4872	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4916	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4916	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4916	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4920	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4920	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4920	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4808	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4808	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe
PID 3016 wrote to memory of 4808	3016	dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe
"C:\Users\Admin\AppData\Local\Temp\dc2e49bf6c97e7882cdb7dd953622fb31dc01e4d7ca02196f740639236683492.exe"
1⤵
- Checks computer location settings
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe" /flushdns
2⤵
- Gathers network information
PID:4848

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe" /registerdns
2⤵
- Gathers network information
PID:4872

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe" /dnsflush
2⤵
- Gathers network information
PID:4916

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe" /renew
2⤵
- Gathers network information
PID:4920

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe" /renew_all
2⤵
- Gathers network information
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-132-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3016-138-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4808-137-0x0000000000000000-mapping.dmp

Download
memory/4848-133-0x0000000000000000-mapping.dmp

Download
memory/4872-134-0x0000000000000000-mapping.dmp

Download
memory/4916-135-0x0000000000000000-mapping.dmp

Download
memory/4920-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads