dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b

Analysis

max time kernel
206s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
Size

312KB
MD5

225781f7bf59c7f0bcd643a9984bdee3
SHA1

034ceb777791bb3764908f8317ff29464b1e0701
SHA256

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b
SHA512

4e4e40940277b039d4fe0fdfbaa4388b9ffea7272a5f781308a29a6d5cdfba5034b7fab6b4e4c6928a33a75f49c4fbb52e093a2a0d83f0eb36cff42dd989e66b
SSDEEP

6144:Bwc+PaJXYd9hxr51WxWHdzvprYZPpYUQ3m1zBdP7F1:/XYd9hxrrYWhvpEZPKr3m1z3Z1

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rnmay.exe

Executes dropped EXE 1 IoCs

pid	Process
4832	rnmay.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /a"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /k"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /A"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /B"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /w"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /i"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /b"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /z"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /S"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /U"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /r"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /e"	rnmay.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /l"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /C"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /o"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /g"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /q"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /H"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /X"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /u"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /K"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /I"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /t"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /j"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /D"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /p"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /v"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /d"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /m"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /n"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /R"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /G"	rnmay.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /J"	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /f"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /E"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /Y"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /Z"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /y"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /F"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /V"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /N"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /M"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /x"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /Q"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /c"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /O"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /h"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /s"	rnmay.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rnmay = "C:\\Users\\Admin\\rnmay.exe /W"	rnmay.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe
4832	rnmay.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
4832	rnmay.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4832	4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe	84
PID 4688 wrote to memory of 4832	4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe	84
PID 4688 wrote to memory of 4832	4688	dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe	84

C:\Users\Admin\AppData\Local\Temp\dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe
"C:\Users\Admin\AppData\Local\Temp\dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\rnmay.exe
  "C:\Users\Admin\rnmay.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4832

Network

DNS

176.122.125.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.122.125.40.in-addr.arpa

IN PTR

Response
DNS

ns1.player1352.com

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

Remote address:

8.8.8.8:53

Request

ns1.player1352.com

IN A

Response
DNS

ns1.player1352.net

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

Remote address:

8.8.8.8:53

Request

ns1.player1352.net

IN A

Response

ns1.player1352.net

IN A

35.205.61.67

8.238.21.126:80

322 B
7
8.238.21.126:80

260 B
5
20.190.159.71:443

260 B
5
104.46.162.226:443

322 B
7
104.80.225.205:443

322 B
7
20.190.159.64:443

260 B
5
8.238.21.126:80

322 B
7
8.238.21.126:80

322 B
7
8.238.21.126:80

322 B
7
35.205.61.67:8003

ns1.player1352.net

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

260 B
5
8.247.211.126:80

46 B
40 B
1
1

8.8.8.8:53

176.122.125.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

176.122.125.40.in-addr.arpa
8.8.8.8:53

ns1.player1352.com

dns

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

64 B
137 B
1
1

DNS Request

ns1.player1352.com
8.8.8.8:53

ns1.player1352.net

dns

dc2cd815e4db618aa84ceae71a725c8d3929cd541f36997803b7884fa93ed12b.exe

64 B
80 B
1
1

DNS Request

ns1.player1352.net

DNS Response

35.205.61.67

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\rnmay.exe

Filesize
312KB

MD5
d4e9a91b95c7febfae3680c5a8fac1a7

SHA1
07463b660ab42a890f97429d3463f90339631bad

SHA256
3b70d68c17d31270cad27d8a19ba01f41a24c3d08ab682a63f48c6510e4ab2a0

SHA512
79008217f869aa5f0304bd2036a756cd95599d6be15f1d8d313168d2550ffc47ad49ecea520fb19236d23df8a59124b4765548890d8aa4c3cc7d143a35223176

Download Submit
C:\Users\Admin\rnmay.exe

Filesize
312KB

MD5
d4e9a91b95c7febfae3680c5a8fac1a7

SHA1
07463b660ab42a890f97429d3463f90339631bad

SHA256
3b70d68c17d31270cad27d8a19ba01f41a24c3d08ab682a63f48c6510e4ab2a0

SHA512
79008217f869aa5f0304bd2036a756cd95599d6be15f1d8d313168d2550ffc47ad49ecea520fb19236d23df8a59124b4765548890d8aa4c3cc7d143a35223176

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.