4dc792effc5c8c7375e85b12afad1bbbe5308fca160380615ab006e4b16d2877

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2023, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_16f296482f4c89exeexe_JC.exe
Size

62KB
MD5

16f296482f4c892d4c2548e529f43830
SHA1

8fd4bced4969f48e842bcf0aa77c5b108cee5722
SHA256

4dc792effc5c8c7375e85b12afad1bbbe5308fca160380615ab006e4b16d2877
SHA512

f79e098eb54b5533c4d05836833ddbd4cbc263d31eb06d3934dcdf3990788d9f2b3d66105cabf56196f0a3bb1bee6cae0df4daf6b6e4273b29fcf58265b5ffc3
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xo3/nyxX:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7m

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	NA_NA_16f296482f4c89exeexe_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	hurok.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	hurok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4864	1688	NA_NA_16f296482f4c89exeexe_JC.exe	86
PID 1688 wrote to memory of 4864	1688	NA_NA_16f296482f4c89exeexe_JC.exe	86
PID 1688 wrote to memory of 4864	1688	NA_NA_16f296482f4c89exeexe_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\NA_NA_16f296482f4c89exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_16f296482f4c89exeexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
3053fe25a80888ce68951966e4e9f282

SHA1
e97bba801673885ea0983d2af89f2147614b2658

SHA256
1b40afb6b0660f00002c74a436e77326b8bfff19e985779c7c9d5489297c9e0b

SHA512
92fd3e78d71e2438ef15a58fc3a4047a18ffc6e6501767438580b510c69997124f27206e414fd775940a4011e2ede6863492c63227994529d2c1dd82e69ef064

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
3053fe25a80888ce68951966e4e9f282

SHA1
e97bba801673885ea0983d2af89f2147614b2658

SHA256
1b40afb6b0660f00002c74a436e77326b8bfff19e985779c7c9d5489297c9e0b

SHA512
92fd3e78d71e2438ef15a58fc3a4047a18ffc6e6501767438580b510c69997124f27206e414fd775940a4011e2ede6863492c63227994529d2c1dd82e69ef064

Download Submit
C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
62KB

MD5
3053fe25a80888ce68951966e4e9f282

SHA1
e97bba801673885ea0983d2af89f2147614b2658

SHA256
1b40afb6b0660f00002c74a436e77326b8bfff19e985779c7c9d5489297c9e0b

SHA512
92fd3e78d71e2438ef15a58fc3a4047a18ffc6e6501767438580b510c69997124f27206e414fd775940a4011e2ede6863492c63227994529d2c1dd82e69ef064

Download Submit
memory/1688-133-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1688-134-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1688-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4864-153-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download