b7525243dd749e9f1cc3e529615d288dfae555d9f39e80c2d4e8ea75a65f7061

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe
Size

56KB
MD5

9b64ecf6bbb7434d137c178324b9ca58
SHA1

d33e52a42a05309d7e689c4d2a532719da14a63e
SHA256

143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03
SHA512

764a9c9ad9f7bb4809dea8295e71b6e1cf80811529647f8321fa62481d1fb0f2fb5ee050a16abe5412200df05ce97af91e1bd28ed0280ad2c3d1fc79915ca742
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzp0oj67JR:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7z

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
4132	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4132	2324	143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe	85
PID 2324 wrote to memory of 4132	2324	143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe	85
PID 2324 wrote to memory of 4132	2324	143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe	85

C:\Users\Admin\AppData\Local\Temp\143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe
"C:\Users\Admin\AppData\Local\Temp\143db2995f3e474d1e42ac48f230786fa67280bba7830f37b5890031a560cd03.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
e039b23923c43b5503e380d05f497145

SHA1
1a207017597f643ddaa7085fd02608b8815895d9

SHA256
db19838285f3ed4f90fda2409894c77508738a70373e993721e6df74c68e6996

SHA512
ad978d01bbb2a5bad6270578df6f2338dba0f923ccfc6940cec59f08d9e243f40270fc698ebc9ca558504e1fc679f16f477935bac7510ddaefcf7f5f65cd6b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
e039b23923c43b5503e380d05f497145

SHA1
1a207017597f643ddaa7085fd02608b8815895d9

SHA256
db19838285f3ed4f90fda2409894c77508738a70373e993721e6df74c68e6996

SHA512
ad978d01bbb2a5bad6270578df6f2338dba0f923ccfc6940cec59f08d9e243f40270fc698ebc9ca558504e1fc679f16f477935bac7510ddaefcf7f5f65cd6b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
56KB

MD5
e039b23923c43b5503e380d05f497145

SHA1
1a207017597f643ddaa7085fd02608b8815895d9

SHA256
db19838285f3ed4f90fda2409894c77508738a70373e993721e6df74c68e6996

SHA512
ad978d01bbb2a5bad6270578df6f2338dba0f923ccfc6940cec59f08d9e243f40270fc698ebc9ca558504e1fc679f16f477935bac7510ddaefcf7f5f65cd6b13

Download Submit
memory/2324-133-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download
memory/2324-134-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download
memory/2324-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4132-153-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download