d81975e6928bab57ee1e4aec83dc6e87e19fb2155ad92e21c36fe48dfa79d641

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6zfAiYDq3alfpMjByDJSwPCR.bin.exe
Size 1.8MB
Sample230719-d4ryzafe69
SHA256 d81975e6928bab57ee1e4aec83dc6e87e19fb2155ad92e21c36fe48dfa79d641
MD5 1c51405e588a5b2ffef997bf2d2e60a0
SHA1 eb427b4c99e7eaa6c707d6ff6895b510690dc6a4
SHA512 bf9995ab1ce72835ca1eb7ae5207e626072241621e873f5fa3df40de7e35b992ce173a5e10c5a22a3219726b5a34cd1391302145c188b4de837acbae86bca5ab
SSDEEP 49152:zeweFLpaQ9xvcJO3bRtYtY0a7CEZnCYUc:zneFhWauY0S9Ce
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	6zfAiYDq3alfpMjByDJSwPCR.bin.exe

Loads dropped DLL 3 IoCs

pid	Process
2364	rundll32.exe
2364	rundll32.exe
1672	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	6zfAiYDq3alfpMjByDJSwPCR.bin.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2232	3088	6zfAiYDq3alfpMjByDJSwPCR.bin.exe	85
PID 3088 wrote to memory of 2232	3088	6zfAiYDq3alfpMjByDJSwPCR.bin.exe	85
PID 3088 wrote to memory of 2232	3088	6zfAiYDq3alfpMjByDJSwPCR.bin.exe	85
PID 2232 wrote to memory of 2364	2232	control.exe	88
PID 2232 wrote to memory of 2364	2232	control.exe	88
PID 2232 wrote to memory of 2364	2232	control.exe	88
PID 2364 wrote to memory of 3876	2364	rundll32.exe	95
PID 2364 wrote to memory of 3876	2364	rundll32.exe	95
PID 3876 wrote to memory of 1672	3876	RunDll32.exe	96
PID 3876 wrote to memory of 1672	3876	RunDll32.exe	96
PID 3876 wrote to memory of 1672	3876	RunDll32.exe	96

C:\Users\Admin\AppData\Local\Temp\6zfAiYDq3alfpMjByDJSwPCR.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6zfAiYDq3alfpMjByDJSwPCR.bin.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
        5⤵
        Loads dropped DLL
        
        PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LJtDWS~O.cpl

Path C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl
Size 1.3MB
SHA256 00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75
MD5 109bbbc448d6f309909170cd22fbbb6e
SHA1 afbfc909e73182950f0690cf003f89bbac7cd89a
SHA512 29849f46e7b67b9b64e52fc00c21624428eaf6ee0b399812c1ef8e769bdd5bf638727882557dab4e1675c2f90b9cecedf70a7a2d7915d56fa20edb0350a5d83a
SSDEEP 24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75
MD5 109bbbc448d6f309909170cd22fbbb6e
SHA1 afbfc909e73182950f0690cf003f89bbac7cd89a
SHA512 29849f46e7b67b9b64e52fc00c21624428eaf6ee0b399812c1ef8e769bdd5bf638727882557dab4e1675c2f90b9cecedf70a7a2d7915d56fa20edb0350a5d83a
SSDEEP 24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75
MD5 109bbbc448d6f309909170cd22fbbb6e
SHA1 afbfc909e73182950f0690cf003f89bbac7cd89a
SHA512 29849f46e7b67b9b64e52fc00c21624428eaf6ee0b399812c1ef8e769bdd5bf638727882557dab4e1675c2f90b9cecedf70a7a2d7915d56fa20edb0350a5d83a
SSDEEP 24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75
MD5 109bbbc448d6f309909170cd22fbbb6e
SHA1 afbfc909e73182950f0690cf003f89bbac7cd89a
SHA512 29849f46e7b67b9b64e52fc00c21624428eaf6ee0b399812c1ef8e769bdd5bf638727882557dab4e1675c2f90b9cecedf70a7a2d7915d56fa20edb0350a5d83a
SSDEEP 24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 00c88d648d3ee12a807566edc7636b2dda3c1bebe1bfd6ebb382c92fe1e02b75
MD5 109bbbc448d6f309909170cd22fbbb6e
SHA1 afbfc909e73182950f0690cf003f89bbac7cd89a
SHA512 29849f46e7b67b9b64e52fc00c21624428eaf6ee0b399812c1ef8e769bdd5bf638727882557dab4e1675c2f90b9cecedf70a7a2d7915d56fa20edb0350a5d83a
SSDEEP 24576:lgpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksIr9:I5LyR177pKYaevy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1672-156-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/1672-157-0x0000000002AC0000-0x0000000002AC6000-memory.dmp

Download

memory/1672-159-0x00000000032B0000-0x00000000033C9000-memory.dmp

Download

memory/1672-160-0x00000000033D0000-0x00000000034CE000-memory.dmp

Download

memory/1672-163-0x00000000033D0000-0x00000000034CE000-memory.dmp

Download

memory/1672-164-0x00000000033D0000-0x00000000034CE000-memory.dmp

Download

memory/2364-147-0x00000000028E0000-0x0000000002A2D000-memory.dmp

Download

memory/2364-149-0x0000000002CB0000-0x0000000002DC9000-memory.dmp

Download

memory/2364-150-0x0000000002DD0000-0x0000000002ECE000-memory.dmp

Download

memory/2364-153-0x0000000002DD0000-0x0000000002ECE000-memory.dmp

Download

memory/2364-154-0x0000000002DD0000-0x0000000002ECE000-memory.dmp

Download

memory/2364-146-0x0000000000A40000-0x0000000000A46000-memory.dmp

Download

memory/2364-145-0x00000000028E0000-0x0000000002A2D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads