949c549fbf47f559d9e0aa2cb247c955a1d9f35d8b7e4bcb675bd8697b081fe2

General

Target
6bfbf792786f767bc33a9dc54d7b0201.bin.exe
Size 1.2MB
Sample230608-c61hfsbf21
SHA256 949c549fbf47f559d9e0aa2cb247c955a1d9f35d8b7e4bcb675bd8697b081fe2
MD5 6bfbf792786f767bc33a9dc54d7b0201
SHA1 672dc2b722a925f1a114adaac97c53929eed1c70
SHA512 5fb36290315a72fe28efc2c8cb8f0c97f82419ee4f369b15059a1777f599b477161d388c3769be9bf8032b8a87282b61477c5543bfd641d4d84af196c70e488f
SSDEEP 12288:tFsdeqmxHyByzDaTzcykayUbdxXb3jr9vm1s+Wl9XDTJ48BIwr+:t+e7H9zu/cykatbDrX9um+6PNB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	6bfbf792786f767bc33a9dc54d7b0201.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe
2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4072	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	90
PID 2320 wrote to memory of 4072	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	90
PID 2320 wrote to memory of 4072	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	90
PID 2320 wrote to memory of 1736	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	92
PID 2320 wrote to memory of 1736	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	92
PID 2320 wrote to memory of 1736	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	92
PID 2320 wrote to memory of 2352	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	93
PID 2320 wrote to memory of 2352	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	93
PID 2320 wrote to memory of 2352	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	93
PID 2320 wrote to memory of 4376	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	94
PID 2320 wrote to memory of 4376	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	94
PID 2320 wrote to memory of 4376	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	94
PID 2320 wrote to memory of 4856	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	95
PID 2320 wrote to memory of 4856	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	95
PID 2320 wrote to memory of 4856	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	95
PID 2320 wrote to memory of 3128	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	96
PID 2320 wrote to memory of 3128	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	96
PID 2320 wrote to memory of 3128	2320	6bfbf792786f767bc33a9dc54d7b0201.bin.exe	96

C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xDjfnZEh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5AD2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
  "{path}"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
  "{path}"
  2⤵
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
  "{path}"
  2⤵
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
  "{path}"
  2⤵
  PID:4856
- C:\Users\Admin\AppData\Local\Temp\6bfbf792786f767bc33a9dc54d7b0201.bin.exe
  "{path}"
  2⤵
  PID:3128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5AD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5AD2.tmp
Size 1KB
SHA256 fc1ee14a1ff94442c266afaa60c5329280ffb7fbd76ca4ef19ea9880b7da5d01
MD5 403b84360d487f5981f7187877ac3344
SHA1 7494da75dc12f8eb2cf995e875bf3704b7c5c18c
SHA512 1d83af434eb2e127aabc854f55364a5bba70d23e32c44223bf28ab4ad5ba1ef3e15d3c2bcaf81ba5c3f7ee5de3ea4857c3b7d7a9a6af55e79d67bb1cb76204b4
MD5 SHA1 SHA512

Submit Download

memory/2320-133-0x0000000000C10000-0x0000000000D56000-memory.dmp

Download

memory/2320-134-0x0000000005560000-0x00000000055FC000-memory.dmp

Download

memory/2320-135-0x0000000005BD0000-0x0000000006174000-memory.dmp

Download

memory/2320-136-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/2320-137-0x00000000056C0000-0x0000000005752000-memory.dmp

Download

memory/2320-138-0x00000000056A0000-0x00000000056AA000-memory.dmp

Download

memory/2320-139-0x00000000058C0000-0x0000000005916000-memory.dmp

Download

memory/2320-140-0x0000000005510000-0x0000000005520000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads