7537d2d83df8cd26afb93fe916f31860c885047ba3ff952d170c0f00554a6f56

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d35e867803700exeexeexeex.exe
Size

55KB
MD5

5d35e8678037005eadf86862c4f58e3b
SHA1

0a015bda5bea42b19b085738418f0a2e653b0059
SHA256

7537d2d83df8cd26afb93fe916f31860c885047ba3ff952d170c0f00554a6f56
SHA512

8602f2d11ca32b11c09a83fa004085c3d0851ffece273e113398ffcdb72453cf0b48ccb56f518bab74c04f5cd31c3ff712798c919c17c92dc4b2da316b965c49
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzp0oj67a:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7e

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	5d35e867803700exeexeexeex.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
228	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 228	2716	5d35e867803700exeexeexeex.exe	83
PID 2716 wrote to memory of 228	2716	5d35e867803700exeexeexeex.exe	83
PID 2716 wrote to memory of 228	2716	5d35e867803700exeexeexeex.exe	83

C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\5d35e867803700exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
25eaa9ee063b1516c787b74ae6987237

SHA1
19f159fca8271da8bc5948658ddd1d6700e32332

SHA256
874b4784edb610b6d2d2008c7f3b040ca53c2b7ecfef34aa657845cf9c33ada5

SHA512
be05796368f90d815fa5584b253e3dfb599e843ea99bcec6cd114733e87d585b37edc4d0fe0377886a30ac0c0c6e8660b9d7d24c79e08de5e7b71da35c3161d1

Download Submit
memory/2716-133-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2716-134-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download