Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2022 07:30
Static task
static1
Behavioral task
behavioral1
Sample
lSQSMS1aatHclJP.exe
Resource
win7-20220812-en
General
-
Target
lSQSMS1aatHclJP.exe
-
Size
734KB
-
MD5
b5ecdb2b4c89d8b2111fef5112b3d59c
-
SHA1
c7e446bbdd1a23d47e860f3bf029ab8fea3621af
-
SHA256
033d52b01807172f9946d2c20c009df5c1a6a65ea153d75cc6e670d2151f79cc
-
SHA512
0e102a230c2e3757e1e5f6e44af8bf14d6f866768d7054dd1f21793374ab6d8090d112558700fab87a31f5e2197fbb6cb215cad72b511a94526a1fcfe3015866
-
SSDEEP
12288:8kMCVc1FDEC8oAc08NZ8OwESaDj3xvvn+EcVt8gnx2cHss/S+PHc42xtAq:pMGc1r8ooiYCj3xvv+9Yux2cHs6Sq84c
Malware Config
Extracted
formbook
fqwu
N6XHavFRXQTRmNUkF9dn
EoaWTgFMmLFmUJ7CJNkTiGoj5A==
Dm+WNJDwSQa5cML3Q7EBiGoj5A==
nixR8ZCkOWjqrASBuic=
yvWQNApkdf4QYIih4+xUDY0=
RtmBQtDYDb50g8btXA==
8SU541y9Ec12NYK8PSOfA8OPpaphimY=
/yEvxvlAkquuY3W1QQ==
AlHZgYW4BiI9V+M=
YsHIUsAOO15j+9TnWA==
JJu1S7QIIMij0xUqlUtv
CmWBLrD98YnyUCCFvy0=
uPwhAVEvtu1rTuY=
PI6bR88GVGXmRlpxpKjtBpo=
GnL7qs9HVQAiF6ckF9dn
2zVeBFKZgO1rTuY=
2VI1VpOg7boCAFxvrWN3ys9rovE=
L1lO62zA2o1QEEZRQtgh7g==
brhF5dY1e3zmSyCFvy0=
U6m2TsEidTTdsA5kX8wh7g==
Y4GrS3nIyUXHj/k=
evSlPgVdYBjdnNQkF9dn
7HUCtkRNj6SnY3W1QQ==
2CcvFnrRHTbivh9eoscp8w==
PCHWsTOfyiggoA==
eMDhhNYhdUDuuQ86Rtf+r1kh5g==
hAIp0HnJFT71dXDVEVxv
51Drsv9Lm7eeYs4kF9dn
fhhRAaH0PgGwevs=
SdfrnVWmDwTBBC1Cj/0x65F2anyxGa5yIw==
GmnwkpPh966c7yJboscp8w==
oeeKSEuAzaf7UX4kF9dn
suBtE+pOocVInNgOJYzbLdd+KqZl
5jD94lyYK0h3WHTPBs5l
1ml5Id01WYmVXeslunurQPBqGrNv
1x1aDGSv2ebPIDdQoscp8w==
B3WmLmHc9Z/uuvf9+rQv5A==
1SNZ9WaU/yfocannICNl/bJ+
/TLNgqMHCaqlY3W1QQ==
vgwl3XnGxogDXHOYKRV+z89rovE=
QHQDuawJPgGwevs=
WL3AW/1KmKwk6GuIEw6lJ7mB/VF/mg==
Qa/rog9XmdMA2luADAavtKqmLtGEqGg=
khGlV8AmrkuV9jxxtXTviGoj5A==
REmSMr42vpiX8Pkf
9n2UI6wXL9Iv7neq3kmHy89rovE=
NV1X+5jl5aoa3yCFvy0=
WBIyLpS5SQLE
4m1+PiV4yiggoA==
iAgZzbQCRHIK3z1noscp8w==
mbvEZscYmU1nY3W1QQ==
FCc/7VKc4gYI1kye4dZ/xpI=
vzFA44C49RbCovcclXrviGoj5A==
fuP0tqb28KKoY3W1QQ==
3B0juCCF1ZZaL6jaXSRp+6OB/VF/mg==
3CLPi5T6PAFGI2/Q2jU=
dAUVvorwPgGwevs=
hO8Su1Ce9R+rAhs0uJ8PV+JqGrNv
o+Hxmip4jlfBeAxIgSbSCCJqGrNv
BD1J/4TpGSom9ovHXC9kfRkB6w==
Q4gYqI7l/5jf2iCFvy0=
zsTo+k1FyiggoA==
6GvplQBQYrm+o/wV
GkvZmK0AUmRs4wwnpnzviGoj5A==
attracttitude.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lSQSMS1aatHclJP.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation lSQSMS1aatHclJP.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
lSQSMS1aatHclJP.exelSQSMS1aatHclJP.exeipconfig.exedescription pid process target process PID 1208 set thread context of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 4544 set thread context of 2640 4544 lSQSMS1aatHclJP.exe Explorer.EXE PID 3912 set thread context of 2640 3912 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3912 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
lSQSMS1aatHclJP.exeipconfig.exepid process 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2640 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
lSQSMS1aatHclJP.exeipconfig.exepid process 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 4544 lSQSMS1aatHclJP.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe 3912 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lSQSMS1aatHclJP.exeipconfig.exedescription pid process Token: SeDebugPrivilege 4544 lSQSMS1aatHclJP.exe Token: SeDebugPrivilege 3912 ipconfig.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
lSQSMS1aatHclJP.exeExplorer.EXEipconfig.exedescription pid process target process PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 1208 wrote to memory of 4544 1208 lSQSMS1aatHclJP.exe lSQSMS1aatHclJP.exe PID 2640 wrote to memory of 3912 2640 Explorer.EXE ipconfig.exe PID 2640 wrote to memory of 3912 2640 Explorer.EXE ipconfig.exe PID 2640 wrote to memory of 3912 2640 Explorer.EXE ipconfig.exe PID 3912 wrote to memory of 740 3912 ipconfig.exe Firefox.exe PID 3912 wrote to memory of 740 3912 ipconfig.exe Firefox.exe PID 3912 wrote to memory of 740 3912 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"C:\Users\Admin\AppData\Local\Temp\lSQSMS1aatHclJP.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-132-0x00000000001E0000-0x000000000029E000-memory.dmpFilesize
760KB
-
memory/1208-133-0x00000000051A0000-0x0000000005744000-memory.dmpFilesize
5.6MB
-
memory/1208-134-0x0000000004C90000-0x0000000004D22000-memory.dmpFilesize
584KB
-
memory/1208-135-0x0000000004C40000-0x0000000004C4A000-memory.dmpFilesize
40KB
-
memory/1208-136-0x0000000008970000-0x0000000008A0C000-memory.dmpFilesize
624KB
-
memory/2640-155-0x0000000007BF0000-0x0000000007D21000-memory.dmpFilesize
1.2MB
-
memory/2640-153-0x0000000007BF0000-0x0000000007D21000-memory.dmpFilesize
1.2MB
-
memory/2640-145-0x0000000002D70000-0x0000000002E28000-memory.dmpFilesize
736KB
-
memory/3912-150-0x00000000003D0000-0x00000000003FD000-memory.dmpFilesize
180KB
-
memory/3912-154-0x00000000003D0000-0x00000000003FD000-memory.dmpFilesize
180KB
-
memory/3912-152-0x0000000000C60000-0x0000000000CEF000-memory.dmpFilesize
572KB
-
memory/3912-151-0x0000000000D60000-0x00000000010AA000-memory.dmpFilesize
3.3MB
-
memory/3912-146-0x0000000000000000-mapping.dmp
-
memory/3912-149-0x00000000002E0000-0x00000000002EB000-memory.dmpFilesize
44KB
-
memory/4544-137-0x0000000000000000-mapping.dmp
-
memory/4544-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4544-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4544-144-0x0000000000EC0000-0x0000000000ED0000-memory.dmpFilesize
64KB
-
memory/4544-142-0x00000000011C0000-0x000000000150A000-memory.dmpFilesize
3.3MB
-
memory/4544-141-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4544-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4544-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB