98f16f0721e9de17ab9c82e79b091a152fd0767aff841981da2d16d5eba99021

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3def3b3b871a3exeexeexeex.exe
Size 34KB
Sample230710-v22ttscc24
SHA256 98f16f0721e9de17ab9c82e79b091a152fd0767aff841981da2d16d5eba99021
MD5 d3def3b3b871a39dddc3f88de567da19
SHA1 5f3958bb5e40dae0838c7ff2183f9886d22dc3ce
SHA512 f177660ae7c2670d7fe9452cc01df77412002a4e2ecc406041364db2d712df4b83aace699947009548397932a3d4ec5baa8fb9a13c9ab83110f902a8c8c6b606
SSDEEP 768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAtl:bc/y2lkF0+Btl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	d3def3b3b871a3exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
3108	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3108	1624	d3def3b3b871a3exeexeexeex.exe	84
PID 1624 wrote to memory of 3108	1624	d3def3b3b871a3exeexeexeex.exe	84
PID 1624 wrote to memory of 3108	1624	d3def3b3b871a3exeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\d3def3b3b871a3exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\d3def3b3b871a3exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rewok.exe

Path C:\Users\Admin\AppData\Local\Temp\rewok.exe
Size 34KB
SHA256 e3f8bd3df4b1ffcf5905e64eab273e8f6cd321f132b71f009570c1bfde5afe76
MD5 d38800af7e4fe8bafb3b2577996de1cb
SHA1 1f53085190f79e256af850f2e1ee955f17dedfdb
SHA512 c748d36e85089285d54a126c82e068045dc35a6325cb89d7b20b30b7d0ca1df21fcf1f2f8056f6e6effed32d1ecffb5589a63c1329d1a57778ba2058659f10a2
SSDEEP 768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAtE:bc/y2lkF0+BtE
MD5 SHA1 SHA512 SSDEEP

Submit Download

rewok.exe

Path C:\Users\Admin\AppData\Local\Temp\rewok.exe
Size 34KB
SHA256 e3f8bd3df4b1ffcf5905e64eab273e8f6cd321f132b71f009570c1bfde5afe76
MD5 d38800af7e4fe8bafb3b2577996de1cb
SHA1 1f53085190f79e256af850f2e1ee955f17dedfdb
SHA512 c748d36e85089285d54a126c82e068045dc35a6325cb89d7b20b30b7d0ca1df21fcf1f2f8056f6e6effed32d1ecffb5589a63c1329d1a57778ba2058659f10a2
SSDEEP 768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAtE:bc/y2lkF0+BtE
MD5 SHA1 SHA512 SSDEEP

Submit Download

rewok.exe

Path C:\Users\Admin\AppData\Local\Temp\rewok.exe
Size 34KB
SHA256 e3f8bd3df4b1ffcf5905e64eab273e8f6cd321f132b71f009570c1bfde5afe76
MD5 d38800af7e4fe8bafb3b2577996de1cb
SHA1 1f53085190f79e256af850f2e1ee955f17dedfdb
SHA512 c748d36e85089285d54a126c82e068045dc35a6325cb89d7b20b30b7d0ca1df21fcf1f2f8056f6e6effed32d1ecffb5589a63c1329d1a57778ba2058659f10a2
SSDEEP 768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAtE:bc/y2lkF0+BtE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1624-133-0x00000000020B0000-0x00000000020B6000-memory.dmp

Download

memory/1624-134-0x0000000000400000-0x0000000000406000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads