d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xmawCzphNPzm.exe
Size 481KB
Sample230616-yttp2age58
SHA256 d34a31171bb2c40cc7d51b5a9090faee60fc2caee9672c0b287ae3f76e9c3d52
MD5 0b6133d5b36cd98c3391f03ae97633d7
SHA1 7773a5b7e7780e93cb12b2d12a2baa98b96b1962
SHA512 c502c2f224235963ed379f88acc5964217e26c50bc25601e9d4ce09a602350609410e5ce978cbc65640cbf7485caf0d101cb02643008d25a37fb29d132be1821
SSDEEP 12288:fRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2cDU:fx7cyF2eSsewS8W47eZO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	xmawCzphNPzm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	xmawCzphNPzm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4100	xmawCzphNPzm.exe
4100	xmawCzphNPzm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4232	4100	xmawCzphNPzm.exe	91
PID 4100 wrote to memory of 4232	4100	xmawCzphNPzm.exe	91
PID 4100 wrote to memory of 4232	4100	xmawCzphNPzm.exe	91

C:\Users\Admin\AppData\Local\Temp\xmawCzphNPzm.exe
"C:\Users\Admin\AppData\Local\Temp\xmawCzphNPzm.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lntfnqncxuuwhaqhzzie.vbs"
  2⤵
  PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

registros.dat

Path C:\ProgramData\remcos\registros.dat
Size 144B
SHA256 76615f97f5ac7e9f2735cfaa7900d3f07fdbb50557d2149a1b9b650bc087d755
MD5 4f538c2b47dacf30e5aa8e250c24ad06
SHA1 8caf41c7bfe408508e597da8ff0d727048ec0477
SHA512 66909c69c361b89d17c1f033d08a82239d5e27dcd584ed731f0da1d21abb13248cf33adeb5f9415d6d7e44c2e0ea7acaf92e0d95dc129401862285985a0edde5
MD5 SHA1 SHA512

Submit Download

lntfnqncxuuwhaqhzzie.vbs

Path C:\Users\Admin\AppData\Local\Temp\lntfnqncxuuwhaqhzzie.vbs
Size 520B
SHA256 b76a7f043f88548a4c7d41cf2f34087673f958f8963ba29e293b5f13aa9e8875
MD5 094c9baaf83a53e0866ab8e53692c9f0
SHA1 cf1edf6eb3d9b1ac61355c346966a9a224155ec8
SHA512 306ce87c02659806650d1405826fa278a2b107889410a5fb2955e83e5c2809987f230c0a1c6ca044d878686804cb65d3df41751f6d0dba52f6f5e931827789ab
MD5 SHA1 SHA512