19973b1a37f7c1667fa424dddaba182fcc3eff26d02cc33ae89099f0ecd3be2e

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2023, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe
Size 2.4MB
Sample230905-d2hmhsdc76
SHA256 19973b1a37f7c1667fa424dddaba182fcc3eff26d02cc33ae89099f0ecd3be2e
MD5 885d9f6b5e3085fa639ffed43aefde24
SHA1 8e16f20bddb67f7f5cf24d0f163c15f010d7a9e5
SHA512 1c78fd23ffcdadbcd8e3fa459eebc5a769f8cb2f60413915583b8c90df9b9409e21656a6366a2fcd48afa6caf38f96126924aed800ec6b60a10c5e5dec156044
SSDEEP 49152:rLL6ygW0dd+VfFU7fVs6T6+3FIw+6sVqGRWoJ3F:rSEU7fpleoKJF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe

Loads dropped DLL 3 IoCs

pid	Process
2924	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3724	1052	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	87
PID 1052 wrote to memory of 3724	1052	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	87
PID 1052 wrote to memory of 3724	1052	SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe	87
PID 3724 wrote to memory of 2924	3724	control.exe	89
PID 3724 wrote to memory of 2924	3724	control.exe	89
PID 3724 wrote to memory of 2924	3724	control.exe	89
PID 2924 wrote to memory of 3928	2924	rundll32.exe	92
PID 2924 wrote to memory of 3928	2924	rundll32.exe	92
PID 3928 wrote to memory of 5032	3928	RunDll32.exe	93
PID 3928 wrote to memory of 5032	3928	RunDll32.exe	93
PID 3928 wrote to memory of 5032	3928	RunDll32.exe	93

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.15310.20352.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl",
        5⤵
        Loads dropped DLL
        
        PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fYc3Bx0.cpl

Path C:\Users\Admin\AppData\Local\Temp\fYc3Bx0.cpl
Size 2.1MB
SHA256 bb1a601022d30c0c9118109abe4324fb75ab0342589382669d2a2fc088191616
MD5 fd3a896f9bdc10907a3e69de0406b475
SHA1 a744911c799725b42a7a1d431d765cd9d2ac1dc0
SHA512 6f91f5a6b9eec97d249a9df835294dcfef70f5029bbd13c53a4d643a2d3a75293e13d2e438a39df87292f81054910cabe9349249c50309f40d4d2528df53504c
SSDEEP 49152:yM4QbOSmbhaNOEgwUPLFz9E4yhGX8G2JUOrIPYM9yrDobk35qMOSQpituyX:ezvwUjL9RsG2Li9yDkaq6UittX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2924-12-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/2924-11-0x0000000002D40000-0x0000000002D46000-memory.dmp

Download

memory/2924-16-0x00000000036C0000-0x0000000003799000-memory.dmp

Download

memory/2924-18-0x00000000036C0000-0x0000000003799000-memory.dmp

Download

memory/2924-19-0x00000000036C0000-0x0000000003799000-memory.dmp

Download

memory/2924-14-0x00000000035C0000-0x00000000036B1000-memory.dmp

Download

memory/2924-15-0x00000000036C0000-0x0000000003799000-memory.dmp

Download

memory/5032-22-0x0000000002620000-0x000000000282E000-memory.dmp

Download

memory/5032-24-0x0000000002620000-0x000000000282E000-memory.dmp

Download

memory/5032-23-0x0000000000C10000-0x0000000000C16000-memory.dmp

Download

memory/5032-27-0x0000000002B50000-0x0000000002C41000-memory.dmp

Download

memory/5032-29-0x0000000000D40000-0x0000000000E19000-memory.dmp

Download

memory/5032-31-0x0000000000D40000-0x0000000000E19000-memory.dmp

Download

memory/5032-32-0x0000000000D40000-0x0000000000E19000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads