6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb

General

Target

6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe
Size

1.6MB
MD5

8d9c93d81f7496cdcfd517e8e4e1a6a0
SHA1

2d203d74f83b2c41a0bd2ea9a9a36f96feb04226
SHA256

6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb
SHA512

d9ef89c742d21d0e9dee711a3f841dd0a1e3588f71ef6d5d6c5239769644274db96072db813d25a576b6cfb0292d9dfc73cabe90dbeb451a1e838572d7a6a7d3
SSDEEP

49152:KyRmWpGGmTgl1cPdbFam0nDcQnpetjVu8aC1MEsVH:KyRmSmTN1qfedViBl

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	rundll32.exe
4204	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1124	4272	6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe	80
PID 4272 wrote to memory of 1124	4272	6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe	80
PID 4272 wrote to memory of 1124	4272	6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe	80
PID 1124 wrote to memory of 1600	1124	control.exe	82
PID 1124 wrote to memory of 1600	1124	control.exe	82
PID 1124 wrote to memory of 1600	1124	control.exe	82
PID 1600 wrote to memory of 2156	1600	rundll32.exe	89
PID 1600 wrote to memory of 2156	1600	rundll32.exe	89
PID 2156 wrote to memory of 4204	2156	RunDll32.exe	90
PID 2156 wrote to memory of 4204	2156	RunDll32.exe	90
PID 2156 wrote to memory of 4204	2156	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe
"C:\Users\Admin\AppData\Local\Temp\6ab27b05a64e477c66cc0addd933a9977d87dd00fc6675ecd1be5b9c3aeabedb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\x356VW.Cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\x356VW.Cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\x356VW.Cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\x356VW.Cpl",
        5⤵
        Loads dropped DLL
        
        PID:4204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x356VW.Cpl

Filesize
1.6MB

MD5
64d5773c5ec8446daf67e8789b623dbf

SHA1
0cf6682241de68d40e54efe009bc847fc56730a7

SHA256
d02e842d597ab8e89b107916ddc68e2d12a8dc1938bae3af80ce6251989d713b

SHA512
189dbb43de17a2749c824a75372a1a8ea043d7f75ae5bbd5c78f8748e69c6dfa6cccadb92cc99d9ac0a4b66adb339c805770cea2dbe694586a2c757e9ed307a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\x356vW.cpl

Filesize
1.6MB

MD5
64d5773c5ec8446daf67e8789b623dbf

SHA1
0cf6682241de68d40e54efe009bc847fc56730a7

SHA256
d02e842d597ab8e89b107916ddc68e2d12a8dc1938bae3af80ce6251989d713b

SHA512
189dbb43de17a2749c824a75372a1a8ea043d7f75ae5bbd5c78f8748e69c6dfa6cccadb92cc99d9ac0a4b66adb339c805770cea2dbe694586a2c757e9ed307a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\x356vW.cpl

Filesize
1.6MB

MD5
64d5773c5ec8446daf67e8789b623dbf

SHA1
0cf6682241de68d40e54efe009bc847fc56730a7

SHA256
d02e842d597ab8e89b107916ddc68e2d12a8dc1938bae3af80ce6251989d713b

SHA512
189dbb43de17a2749c824a75372a1a8ea043d7f75ae5bbd5c78f8748e69c6dfa6cccadb92cc99d9ac0a4b66adb339c805770cea2dbe694586a2c757e9ed307a6

Download Submit
memory/1600-136-0x0000000003040000-0x00000000031D4000-memory.dmp

Filesize
1.6MB

Download
memory/1600-137-0x0000000072B30000-0x0000000072CCD000-memory.dmp

Filesize
1.6MB

Download
memory/1600-138-0x00000000029C0000-0x0000000002A9E000-memory.dmp

Filesize
888KB

Download
memory/1600-139-0x0000000002EB0000-0x0000000002F7A000-memory.dmp

Filesize
808KB

Download
memory/1600-140-0x0000000002EB0000-0x0000000002F7A000-memory.dmp

Filesize
808KB

Download
memory/1600-142-0x0000000072B30000-0x0000000072CCD000-memory.dmp

Filesize
1.6MB

Download
memory/4204-146-0x00000000031E0000-0x0000000003374000-memory.dmp

Filesize
1.6MB

Download
memory/4204-147-0x00000000038F0000-0x00000000039CE000-memory.dmp

Filesize
888KB

Download
memory/4204-148-0x00000000039D0000-0x0000000003A9A000-memory.dmp

Filesize
808KB

Download
memory/4204-149-0x00000000039D0000-0x0000000003A9A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing