Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2023, 05:31
Static task
static1
General
-
Target
RejSpacer72.exe
-
Size
1.1MB
-
MD5
bd481fbe21d690f2e15243f233fe1f92
-
SHA1
afd3b8d8c9e75b748d759e7fa73d5a1470e08a13
-
SHA256
cb6f91dc0ef15705a4449ece2ee7324c9e24a75dbf852651d095179dcaf2739b
-
SHA512
8a4790612726cf81ea5b22bec9a18f29cf89c2afa8b8682ce53bcce54aaf112db3e3d219aa6d5996b1ef79269ec5946210c67eba4fc12932b993b90839dfbc41
-
SSDEEP
24576:QhIpFgNyp/e06M4Vn5JL/OJoHG87aq9lWVJ:kwvN4V5J3J2
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation RejSpacer72.exe -
Executes dropped EXE 1 IoCs
pid Process 2248 6QC5LufDLiAxuJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2644 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3560 RejSpacer72.exe 3560 RejSpacer72.exe 3560 RejSpacer72.exe 3560 RejSpacer72.exe 3560 RejSpacer72.exe 3560 RejSpacer72.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2644 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3560 wrote to memory of 2248 3560 RejSpacer72.exe 83 PID 3560 wrote to memory of 2248 3560 RejSpacer72.exe 83 PID 3560 wrote to memory of 2248 3560 RejSpacer72.exe 83 PID 3560 wrote to memory of 4780 3560 RejSpacer72.exe 91 PID 3560 wrote to memory of 4780 3560 RejSpacer72.exe 91 PID 3560 wrote to memory of 4780 3560 RejSpacer72.exe 91 PID 4780 wrote to memory of 2644 4780 cmd.exe 93 PID 4780 wrote to memory of 2644 4780 cmd.exe 93 PID 4780 wrote to memory of 2644 4780 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\RejSpacer72.exe"C:\Users\Admin\AppData\Local\Temp\RejSpacer72.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Roaming\{f4724154-103f-11ee-9fa7-806e6f6e6963}\6QC5LufDLiAxuJ.exe2⤵
- Executes dropped EXE
PID:2248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "RejSpacer72.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\RejSpacer72.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "RejSpacer72.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c
-
Filesize
72KB
MD53fb36cb0b7172e5298d2992d42984d06
SHA1439827777df4a337cbb9fa4a4640d0d3fa1738b7
SHA25627ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6
SHA5126b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c