db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b

Analysis

max time kernel
169s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

decrypted_2.exe
Size

479KB
MD5

73d9cfaa50432fbb0133e3abfce5f40c
SHA1

6ff96f23aef03fbf7efdee970304005cfae8f088
SHA256

d73e9d1fc1c5eca7d3e3c236833f6f98ec189d57aadd08bee5806170cdab6c1a
SHA512

46d8901bcd853cbff340cd85a0bc980e782a174aa4c8204f7cd7a577c080442e78fb89ed49837cf7a7574ef85e31c70b4baeab292281ed3fe8e19671344eeb2a
SSDEEP

6144:UTouKrWBEu3/Z2lpGDHU3ykJmnRT/EXsbIh/JW6skkf28J:UToPWBv/cpGrU3y/nNesbIZJW6nSfJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	decrypted_2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Glitch_loader.exe

Executes dropped EXE 3 IoCs

pid	Process
392	Glitch_loader.exe
1384	wlninit.exe
1108	Glitcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 392	2288	decrypted_2.exe	83
PID 2288 wrote to memory of 392	2288	decrypted_2.exe	83
PID 2288 wrote to memory of 392	2288	decrypted_2.exe	83
PID 392 wrote to memory of 1384	392	Glitch_loader.exe	86
PID 392 wrote to memory of 1384	392	Glitch_loader.exe	86
PID 392 wrote to memory of 1384	392	Glitch_loader.exe	86
PID 2288 wrote to memory of 1108	2288	decrypted_2.exe	87
PID 2288 wrote to memory of 1108	2288	decrypted_2.exe	87

C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe
"C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Users\Admin\AppData\Roaming\wlninit.exe
    "C:\Users\Admin\AppData\Roaming\wlninit.exe"
    3⤵
    - Executes dropped EXE
    PID:1384
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe"
  2⤵
  - Executes dropped EXE
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
C:\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
memory/392-135-0x0000000073000000-0x00000000735B1000-memory.dmp

Filesize
5.7MB

Download
memory/392-136-0x0000000073000000-0x00000000735B1000-memory.dmp

Filesize
5.7MB

Download
memory/392-141-0x0000000073000000-0x00000000735B1000-memory.dmp

Filesize
5.7MB

Download
memory/1108-146-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/1108-147-0x00007FF9C0AC0000-0x00007FF9C1581000-memory.dmp

Filesize
10.8MB

Download
memory/1108-148-0x00007FF9C0AC0000-0x00007FF9C1581000-memory.dmp

Filesize
10.8MB

Download
memory/1384-142-0x0000000073000000-0x00000000735B1000-memory.dmp

Filesize
5.7MB

Download
memory/1384-140-0x0000000073000000-0x00000000735B1000-memory.dmp

Filesize
5.7MB

Download