09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c

General

Target

09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
Size

461KB
MD5

fda9ffcb50b7a2e3c957ce378ea151a7
SHA1

36814cf9d20c86cdc892fa0ab1c7a131d844c933
SHA256

09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c
SHA512

3637cadd011ec39dca6933f769a276bb2c51efece849bd8824948697b9c366410e265dfb3a4b5ac02a061d140ecab4a1dd7409b6d9ba7e6bef0ac4f2e850ef48
SSDEEP

12288:GFszBhqS5mvTyPDqW8Wu7nQhqtOpwaoLFHOa90Ry:GFszWS5UTyLqMu7upwaoLFHr9f

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MAgent = "C:\\Program Files\\Mail.Ru\\Agent\\MAgent.exe -LM"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svcnost.exe = "\"C:\\WINDOWS\\system32\\svcnost.exe\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon = "RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter = "RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\egui = "\"C:\\Program Files\\ESET\\ESET NOD32 Antivirus\\egui.exe\" /hide /waitservice"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\USB Antivirus = "C:\\Program Files\\USB Disk Security\\USBGuard.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2Gis Update Notifier = "\"C:\\Program Files\\2gis\\3.0\\2GISTrayNotifier.exe\" -delayed_start"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NeroFilterCheck = "C:\\Program Files\\Common Files\\Nero\\Lib\\NeroCheck.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NBKeyScan = "\"C:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Guard.Mail.ru.gui = "\"C:\\Program Files\\Mail.Ru\\Guard\\GuardMailRu.exe\" /gui"	regedit.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\cmdow.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\raddrv.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\sistem.reg	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\odnoklassniki besplatnye podarki i smaily.lnk	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\odnoklassniki besplatnye podarki i smaily.lnk	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\svcnost.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\svcnost.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\blat.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\blat.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\blat.lib	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\__tmp_rar_sfx_access_check_240568484	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\blat.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\blat.lib	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\cmdow.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\raddrv.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\blat.exe	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\admdll.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File opened for modification	C:\WINDOWS\SysWOW64\sistem.reg	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
File created	C:\WINDOWS\SysWOW64\admdll.dll	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
2852	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2852	1496	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe	76
PID 1496 wrote to memory of 2852	1496	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe	76
PID 1496 wrote to memory of 2852	1496	09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe	76

C:\Users\Admin\AppData\Local\Temp\09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe
"C:\Users\Admin\AppData\Local\Temp\09adcc3db610b4f19696db9c601ec2b51d49dc29fd164a16f065a6086c03b01c.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s sistem.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sistem.reg

Filesize
1KB

MD5
ffff23c3f97b501f8da8c8aabec52542

SHA1
ac1fb02239cc35a1d823e9a6498f6fcec5374800

SHA256
047d5ae38b8a76a0151fdde06edfbb76bb091114a4793223da0877a10b3e6492

SHA512
43b150d863a512e91e57dba5c8a54604f48a206cfbb4900967a752b8355a6d2da9da87b5f6cec91e23948b5ac011cb8430f1185a8bff3c1d1ba079ceed6768da

Download Submit

Analysis

Sharing