46cd40aeaaa2e36bd207cc50e3d8b54f064592f5413461e5cf44371fae5fab57

General

Target

a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe
Size

1.6MB
MD5

cec434e1b94beae9dbbf0eb371e78f4a
SHA1

e318e77b036852ef9f4780b07e33e075635b93a5
SHA256

a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef
SHA512

d3e4a9c0e529ab48893d877b19d9a3c6b59bb5b68c1cb2063a510632fc1895ce1e7a0f0c33737361de6de0adea611b000496c3328034d942cae948ead5f8981d
SSDEEP

24576:WiIy60hvWIUiQjUo7zRb+YSqs18b6H9vOWQx1WvxE1ENo0fbSSvC4PnUue6VIsma:mb1x459mWwwvxEKoyvCWUuexH7PCWc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe

Loads dropped DLL 3 IoCs

pid	Process
756	rundll32.exe
3708	rundll32.exe
3708	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3584	3868	a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe	86
PID 3868 wrote to memory of 3584	3868	a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe	86
PID 3868 wrote to memory of 3584	3868	a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe	86
PID 3584 wrote to memory of 756	3584	control.exe	87
PID 3584 wrote to memory of 756	3584	control.exe	87
PID 3584 wrote to memory of 756	3584	control.exe	87
PID 756 wrote to memory of 1772	756	rundll32.exe	95
PID 756 wrote to memory of 1772	756	rundll32.exe	95
PID 1772 wrote to memory of 3708	1772	RunDll32.exe	96
PID 1772 wrote to memory of 3708	1772	RunDll32.exe	96
PID 1772 wrote to memory of 3708	1772	RunDll32.exe	96

C:\Users\Admin\AppData\Local\Temp\a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe
"C:\Users\Admin\AppData\Local\Temp\a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" .\ZnTnW.Q
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\ZnTnW.Q
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\ZnTnW.Q
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\ZnTnW.Q
        5⤵
        Loads dropped DLL
        
        PID:3708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
memory/756-140-0x0000000003130000-0x0000000003246000-memory.dmp

Filesize
1.1MB

Download
memory/756-141-0x0000000003250000-0x000000000334B000-memory.dmp

Filesize
1004KB

Download
memory/756-144-0x0000000003250000-0x000000000334B000-memory.dmp

Filesize
1004KB

Download
memory/756-145-0x0000000003250000-0x000000000334B000-memory.dmp

Filesize
1004KB

Download
memory/756-137-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/756-138-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/3708-148-0x0000000000DD0000-0x0000000000F13000-memory.dmp

Filesize
1.3MB

Download
memory/3708-149-0x0000000000D60000-0x0000000000D66000-memory.dmp

Filesize
24KB

Download
memory/3708-150-0x0000000000DD0000-0x0000000000F13000-memory.dmp

Filesize
1.3MB

Download
memory/3708-153-0x00000000029B0000-0x0000000002AC6000-memory.dmp

Filesize
1.1MB

Download
memory/3708-154-0x0000000002AD0000-0x0000000002BCB000-memory.dmp

Filesize
1004KB

Download
memory/3708-157-0x0000000002AD0000-0x0000000002BCB000-memory.dmp

Filesize
1004KB

Download
memory/3708-158-0x0000000002AD0000-0x0000000002BCB000-memory.dmp

Filesize
1004KB

Download

Analysis

Sharing