6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6

General

Target

6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe
Size

1.8MB
MD5

b15a0e59e709856f57c011a4110fae6b
SHA1

53b9ba00065d07992fab361316441de49eda1626
SHA256

6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6
SHA512

f79f92a8f6bbdb7902f676f712ebfb61ffc0ba14020c09bf397ea1ce56fc17f64227a345c61d0e63de51fe27d828c7d8961ed9026a556efe4815a9661e7012d3
SSDEEP

49152:zereFL30O/xFBOFFW34tx9sZ7/3UY0nb5D:zueFF/xrMO4P9s10t

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe

Loads dropped DLL 2 IoCs

pid	Process
220	rundll32.exe
1132	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 744	1576	6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe	85
PID 1576 wrote to memory of 744	1576	6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe	85
PID 1576 wrote to memory of 744	1576	6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe	85
PID 744 wrote to memory of 220	744	control.exe	87
PID 744 wrote to memory of 220	744	control.exe	87
PID 744 wrote to memory of 220	744	control.exe	87
PID 220 wrote to memory of 716	220	rundll32.exe	94
PID 220 wrote to memory of 716	220	rundll32.exe	94
PID 716 wrote to memory of 1132	716	RunDll32.exe	95
PID 716 wrote to memory of 1132	716	RunDll32.exe	95
PID 716 wrote to memory of 1132	716	RunDll32.exe	95

C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe
"C:\Users\Admin\AppData\Local\Temp\6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
        5⤵
        Loads dropped DLL
        
        PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl

Filesize
1.3MB

MD5
c18be9990d123202d3a6f04d2565c9fc

SHA1
15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

SHA256
fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

SHA512
6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

Download Submit
C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

Filesize
1.3MB

MD5
c18be9990d123202d3a6f04d2565c9fc

SHA1
15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

SHA256
fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

SHA512
6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

Download Submit
C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

Filesize
1.3MB

MD5
c18be9990d123202d3a6f04d2565c9fc

SHA1
15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

SHA256
fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

SHA512
6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

Download Submit
C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl

Filesize
1.3MB

MD5
c18be9990d123202d3a6f04d2565c9fc

SHA1
15ffd3ff9f0d3b96e78d87cd2a8141f060c67902

SHA256
fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9

SHA512
6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296

Download Submit
memory/220-144-0x0000000000C90000-0x0000000000C96000-memory.dmp

Filesize
24KB

Download
memory/220-147-0x0000000002D10000-0x0000000002E29000-memory.dmp

Filesize
1.1MB

Download
memory/220-148-0x0000000002E30000-0x0000000002F2E000-memory.dmp

Filesize
1016KB

Download
memory/220-151-0x0000000002E30000-0x0000000002F2E000-memory.dmp

Filesize
1016KB

Download
memory/220-152-0x0000000002E30000-0x0000000002F2E000-memory.dmp

Filesize
1016KB

Download
memory/220-145-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1132-154-0x0000000002710000-0x0000000002716000-memory.dmp

Filesize
24KB

Download
memory/1132-157-0x0000000002F50000-0x0000000003069000-memory.dmp

Filesize
1.1MB

Download
memory/1132-158-0x0000000003070000-0x000000000316E000-memory.dmp

Filesize
1016KB

Download
memory/1132-161-0x0000000003070000-0x000000000316E000-memory.dmp

Filesize
1016KB

Download
memory/1132-162-0x0000000003070000-0x000000000316E000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing