b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c

General

Target
b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe
Size 8KB
Sample221204-gdnqeabc87
SHA256 b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c
MD5 95ca46e425c65eecb92e9bf5905a8734
SHA1 0002c7d86cd444c9c35ee63c2fe5074425a9ef3b
SHA512 3242b706d268a3ed44f8629f22785be4791134dfee2635223f4de47571442fff48e44dffba6302652b4787d34a65992f18d0fc472c434a69a13888110c398ee3
SSDEEP 192:v6sxjGjptx7gvtcuKFaNJhLkwcud2DH9VwGfctl3O:Sjptx7gdOaNJawcudoD7US
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1620	b2e.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/984-135-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1620	984	b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe	81
PID 984 wrote to memory of 1620	984	b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe	81
PID 984 wrote to memory of 1620	984	b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe	81
PID 1620 wrote to memory of 3752	1620	b2e.exe	82
PID 1620 wrote to memory of 3752	1620	b2e.exe	82
PID 1620 wrote to memory of 3752	1620	b2e.exe	82
PID 3752 wrote to memory of 5048	3752	cmd.exe	85
PID 3752 wrote to memory of 5048	3752	cmd.exe	85
PID 3752 wrote to memory of 5048	3752	cmd.exe	85
PID 5048 wrote to memory of 5028	5048	rundll32.exe	86
PID 5048 wrote to memory of 5028	5048	rundll32.exe	86
PID 1620 wrote to memory of 1680	1620	b2e.exe	89
PID 1620 wrote to memory of 1680	1620	b2e.exe	89
PID 1620 wrote to memory of 1680	1620	b2e.exe	89

C:\Users\Admin\AppData\Local\Temp\b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe
"C:\Users\Admin\AppData\Local\Temp\b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\A7ED.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\A7ED.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A7ED.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\b372192db8b6a96bf811aa6250219beeef159ee9e1ffd4c8e1e0b005f3ea4f0c.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B8D5.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 printui.dll,PrintUIEntry /in /n\\10.100.62.110\Laserjet42
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A7ED.tmp\b2e.exe
Size 8KB
SHA256 3f3a4b7b9a9148188c082e52f4e41c597e56154490fd97a7076a7f010eff6eb6
MD5 099c30e2db63080af1b2fdd6a42a69c0
SHA1 3688d105d581159d4be011731119a8396eabba81
SHA512 2bee0a104c5d1bdfba19580a18bb2f3613df3ac3f2c29989771761c74b2936453e2fa1eaf96d1c5dc2eaa3641c9c4b3c4cef488bd48b1b0e3f615889a650a5e9
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcW:3R5Fhp8cdwpHR3AkPLiM79mLU2PcW
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A7ED.tmp\b2e.exe
Size 8KB
SHA256 3f3a4b7b9a9148188c082e52f4e41c597e56154490fd97a7076a7f010eff6eb6
MD5 099c30e2db63080af1b2fdd6a42a69c0
SHA1 3688d105d581159d4be011731119a8396eabba81
SHA512 2bee0a104c5d1bdfba19580a18bb2f3613df3ac3f2c29989771761c74b2936453e2fa1eaf96d1c5dc2eaa3641c9c4b3c4cef488bd48b1b0e3f615889a650a5e9
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcW:3R5Fhp8cdwpHR3AkPLiM79mLU2PcW
MD5 SHA1 SHA512 SSDEEP

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\B8D5.tmp\batchfile.bat
Size 66B
SHA256 9031e0ffdbb17a235774d007d64ea339cf350f943b4d6b2e2de64abb7b1bed3c
MD5 c20d89b0b0af4dedc1ec6f6b9096d7f1
SHA1 8b3bef7a6a4c35e648e61bf040a1b57fadb36366
SHA512 e56b69124ebb6f5e01218d9354f717ac8060f93aa24db5392c468093872e67a6a7ae7023f07d9c6f1f3834a74e0d7989674a1cc0ccec1b5c8004bc7e0a559a63
MD5 SHA1 SHA512

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 5a06cb8d4b110db59be41c3cabfd561bb8e20d51ef053e694f86ba44691a9ae5
MD5 79f328a34cb2dedbe4f1464c41f11ba7
SHA1 68f2bb362623ee0f0db232df9323d1bf937ce58e
SHA512 f236c843f85cf4860e95f8736e699c2c18f346df88b0cb6e1929e32e83ff4b692bd5dde246d4aaca9097b76fab79eb63235c302df74eea643839d54e3d691f03
MD5 SHA1 SHA512

Submit Download

memory/984-135-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/1620-142-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1620-145-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads