b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc

General

Target

b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe
Size

1.3MB
MD5

123db5af123b0e29cef6ccd20cad02da
SHA1

3539f23d4b7f167170f3ca33b51a6479f3d66968
SHA256

b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc
SHA512

320b9a4b7aeda1188a25de35e5b84cc9a4914b12458a6224af19185aa56dfc6b58f247da82df6a7a1af543e49a66cf8abb0486b62d00097beec6d432e49b15d5
SSDEEP

24576:mQ6Ng36dXhRyGRbg8C8UiQ6Ng36dXhRyGRbg8C8Uw:mQ2m6dXLzQ2m6dXL

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

LocalZpcmujrjqf.exeLocalryyreunufx.exestxl.exe

pid process

4580 LocalZpcmujrjqf.exe
1720 Localryyreunufx.exe
3464 stxl.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1264 netsh.exe

pid	process
4580	LocalZpcmujrjqf.exe
1720	Localryyreunufx.exe
3464	stxl.exe

pid	process
1264	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exeLocalZpcmujrjqf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	LocalZpcmujrjqf.exe

Drops startup file 2 IoCs

Processes:

stxl.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\49a285fef7428533bfa38388e756cb42.exe	stxl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\49a285fef7428533bfa38388e756cb42.exe	stxl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

stxl.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\49a285fef7428533bfa38388e756cb42 = "\"C:\\ProgramData\\stxl.exe\" .."	stxl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\49a285fef7428533bfa38388e756cb42 = "\"C:\\ProgramData\\stxl.exe\" .."	stxl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

stxl.exe

pid	process
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe
3464	stxl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

stxl.exe

description pid process

Token: SeDebugPrivilege 3464 stxl.exe

description	pid	process
Token: SeDebugPrivilege	3464	stxl.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exeLocalZpcmujrjqf.exestxl.exe

description	pid	process	target process
PID 4100 wrote to memory of 4580	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	LocalZpcmujrjqf.exe
PID 4100 wrote to memory of 4580	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	LocalZpcmujrjqf.exe
PID 4100 wrote to memory of 4580	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	LocalZpcmujrjqf.exe
PID 4100 wrote to memory of 1720	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	Localryyreunufx.exe
PID 4100 wrote to memory of 1720	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	Localryyreunufx.exe
PID 4100 wrote to memory of 1720	4100	b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe	Localryyreunufx.exe
PID 4580 wrote to memory of 3464	4580	LocalZpcmujrjqf.exe	stxl.exe
PID 4580 wrote to memory of 3464	4580	LocalZpcmujrjqf.exe	stxl.exe
PID 4580 wrote to memory of 3464	4580	LocalZpcmujrjqf.exe	stxl.exe
PID 3464 wrote to memory of 1264	3464	stxl.exe	netsh.exe
PID 3464 wrote to memory of 1264	3464	stxl.exe	netsh.exe
PID 3464 wrote to memory of 1264	3464	stxl.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe
"C:\Users\Admin\AppData\Local\Temp\b41faf5253e0eef6e383dc99c246e183581fcadcd2611d4d8c241e00f82852cc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\LocalZpcmujrjqf.exe
  "C:\Users\Admin\AppData\LocalZpcmujrjqf.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\ProgramData\stxl.exe
    "C:\ProgramData\stxl.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\stxl.exe" "stxl.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1264
- C:\Users\Admin\AppData\Localryyreunufx.exe
  "C:\Users\Admin\AppData\Localryyreunufx.exe"
  2⤵
  - Executes dropped EXE
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\stxl.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
C:\ProgramData\stxl.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
C:\Users\Admin\AppData\LocalZpcmujrjqf.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
C:\Users\Admin\AppData\LocalZpcmujrjqf.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
C:\Users\Admin\AppData\Localryyreunufx.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
C:\Users\Admin\AppData\Localryyreunufx.exe

Filesize
586KB

MD5
2f3ed46be170f14fdd93057e1147249d

SHA1
b90798a6d85c1012315d2819051720b95468279d

SHA256
8f692ae2e19568d2444eeb058a825d5e3213cbc11bca0ebb3fe85b584977ebc0

SHA512
997a0c20f0b55e6677f320e6b6f74940b7aa74178ad5262d30438851892d3870df3b7e0bd64cc112ef219be9294ff577e3b2e75fe04b7aa7b50fbf91bbb35bb7

Download Submit
memory/1264-146-0x0000000000000000-mapping.dmp

Download
memory/1720-136-0x0000000000000000-mapping.dmp

Download
memory/1720-141-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/1720-139-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/3464-143-0x0000000000000000-mapping.dmp

Download
memory/3464-148-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/3464-149-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/4100-132-0x00007FFA484B0000-0x00007FFA48EE6000-memory.dmp

Filesize
10.2MB

Download
memory/4580-140-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/4580-142-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download
memory/4580-133-0x0000000000000000-mapping.dmp

Download
memory/4580-147-0x00000000751B0000-0x0000000075761000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads