10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0

General

Target

10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe
Size

1.3MB
MD5

13a9d5ed56d08eb6b77ae5e6fe86d483
SHA1

978329998ebf9803bbcca7ad068ec63b4df8d571
SHA256

10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0
SHA512

d4058b05f6a10ff37c47cfb5989209085986fe802f39bbeb2961a534aa9e5be16be804eb71fe6a9db794d57c1a4d18a06aebbf3b041029a224fcfc1329f9ebce
SSDEEP

24576:5OtT5xvEeZC0xO9fYQjEDi5ISFmeMAvQtkYx2d4sLXnhFCFHUt4MjLeV00L:5OtT/Z3xEYmEDaMBM4QzClUG8Gf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe

Loads dropped DLL 3 IoCs

pid	Process
3376	rundll32.exe
1796	rundll32.exe
1796	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 4264	2708	10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe	84
PID 2708 wrote to memory of 4264	2708	10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe	84
PID 2708 wrote to memory of 4264	2708	10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe	84
PID 4264 wrote to memory of 3376	4264	control.exe	86
PID 4264 wrote to memory of 3376	4264	control.exe	86
PID 4264 wrote to memory of 3376	4264	control.exe	86
PID 3376 wrote to memory of 1704	3376	rundll32.exe	89
PID 3376 wrote to memory of 1704	3376	rundll32.exe	89
PID 1704 wrote to memory of 1796	1704	RunDll32.exe	90
PID 1704 wrote to memory of 1796	1704	RunDll32.exe	90
PID 1704 wrote to memory of 1796	1704	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe
"C:\Users\Admin\AppData\Local\Temp\10fd080ae5a090912a8d7b14505a91ca9bcbde7561fa3bc3fa9cd10cc7e5ecb0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\rlu1YVC.CpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\rlu1YVC.CpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\rlu1YVC.CpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\rlu1YVC.CpL",
        5⤵
        Loads dropped DLL
        
        PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rlu1YVC.CpL

Filesize
1.1MB

MD5
5096c4dc30b3dd78d0cec11f991ea41a

SHA1
7ec58a7653d61409b4a15fadf37e8450746c2db2

SHA256
888605a75f5f7961a30aeac7fa2cf2c6701adf0605e37bde89ab454a4af70e28

SHA512
16ddad81dbaf58e51019490ebb5713e2ed0a8b1126724d5bedcb5bcde716b2b2362ab68a7c631a7a9cd04e0c41799aaf880a728111e323cd842eeba453817c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rlu1YVC.cpl

Filesize
1.1MB

MD5
5096c4dc30b3dd78d0cec11f991ea41a

SHA1
7ec58a7653d61409b4a15fadf37e8450746c2db2

SHA256
888605a75f5f7961a30aeac7fa2cf2c6701adf0605e37bde89ab454a4af70e28

SHA512
16ddad81dbaf58e51019490ebb5713e2ed0a8b1126724d5bedcb5bcde716b2b2362ab68a7c631a7a9cd04e0c41799aaf880a728111e323cd842eeba453817c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rlu1YVC.cpl

Filesize
1.1MB

MD5
5096c4dc30b3dd78d0cec11f991ea41a

SHA1
7ec58a7653d61409b4a15fadf37e8450746c2db2

SHA256
888605a75f5f7961a30aeac7fa2cf2c6701adf0605e37bde89ab454a4af70e28

SHA512
16ddad81dbaf58e51019490ebb5713e2ed0a8b1126724d5bedcb5bcde716b2b2362ab68a7c631a7a9cd04e0c41799aaf880a728111e323cd842eeba453817c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rlu1YVC.cpl

Filesize
1.1MB

MD5
5096c4dc30b3dd78d0cec11f991ea41a

SHA1
7ec58a7653d61409b4a15fadf37e8450746c2db2

SHA256
888605a75f5f7961a30aeac7fa2cf2c6701adf0605e37bde89ab454a4af70e28

SHA512
16ddad81dbaf58e51019490ebb5713e2ed0a8b1126724d5bedcb5bcde716b2b2362ab68a7c631a7a9cd04e0c41799aaf880a728111e323cd842eeba453817c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rlu1YVC.cpl

Filesize
1.1MB

MD5
5096c4dc30b3dd78d0cec11f991ea41a

SHA1
7ec58a7653d61409b4a15fadf37e8450746c2db2

SHA256
888605a75f5f7961a30aeac7fa2cf2c6701adf0605e37bde89ab454a4af70e28

SHA512
16ddad81dbaf58e51019490ebb5713e2ed0a8b1126724d5bedcb5bcde716b2b2362ab68a7c631a7a9cd04e0c41799aaf880a728111e323cd842eeba453817c1c

Download Submit
memory/1796-156-0x00000000024D0000-0x00000000025EA000-memory.dmp

Filesize
1.1MB

Download
memory/1796-164-0x0000000000A90000-0x0000000000B5B000-memory.dmp

Filesize
812KB

Download
memory/1796-163-0x0000000000A90000-0x0000000000B5B000-memory.dmp

Filesize
812KB

Download
memory/1796-160-0x0000000000A90000-0x0000000000B5B000-memory.dmp

Filesize
812KB

Download
memory/1796-159-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/1796-158-0x0000000002870000-0x0000000002952000-memory.dmp

Filesize
904KB

Download
memory/1796-155-0x00000000024D0000-0x00000000025EA000-memory.dmp

Filesize
1.1MB

Download
memory/3376-146-0x0000000002DB0000-0x0000000002DB6000-memory.dmp

Filesize
24KB

Download
memory/3376-152-0x0000000003180000-0x000000000324B000-memory.dmp

Filesize
812KB

Download
memory/3376-151-0x0000000003180000-0x000000000324B000-memory.dmp

Filesize
812KB

Download
memory/3376-148-0x0000000003180000-0x000000000324B000-memory.dmp

Filesize
812KB

Download
memory/3376-147-0x0000000003090000-0x0000000003172000-memory.dmp

Filesize
904KB

Download
memory/3376-144-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing