b4ca413f722daa7f23e077294f5526522e4fa4d191daa2441f3049f967f91c61

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2023, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe
Size 2.5MB
Sample230906-nsvwlafa3v
SHA256 b4ca413f722daa7f23e077294f5526522e4fa4d191daa2441f3049f967f91c61
MD5 7e6bbae9b61ed5682e0e63869b12562c
SHA1 8b1c9811e1f88b5cdeb74918cdefb6aaecd4f73e
SHA512 06e84cb8eba804e3d045315acd951feceba32e43bbc861435c524572ee90780c6f51991545329143b6e553ab09e7c41713b5a7db3b5b0317ec506a0416bc2ebe
SSDEEP 49152:kWhSV4BfJXAEgOhq4Pzg/PU0tcQfsIvh58qO4tcy3XiWLlC/Bc7cBFwpk1:kWhSeBfKEJhq4s/HOQf958qOJsnLlQ7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe

Loads dropped DLL 2 IoCs

pid	Process
3872	rundll32.exe
4460	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings	SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1088	2920	SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe	84
PID 2920 wrote to memory of 1088	2920	SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe	84
PID 2920 wrote to memory of 1088	2920	SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe	84
PID 1088 wrote to memory of 3872	1088	control.exe	86
PID 1088 wrote to memory of 3872	1088	control.exe	86
PID 1088 wrote to memory of 3872	1088	control.exe	86
PID 3872 wrote to memory of 1676	3872	rundll32.exe	87
PID 3872 wrote to memory of 1676	3872	rundll32.exe	87
PID 1676 wrote to memory of 4460	1676	RunDll32.exe	88
PID 1676 wrote to memory of 4460	1676	RunDll32.exe	88
PID 1676 wrote to memory of 4460	1676	RunDll32.exe	88

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.InjectorX-gen.13287.9008.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\5XHGhY8X.cPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5XHGhY8X.cPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5XHGhY8X.cPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\5XHGhY8X.cPl",
        5⤵
        Loads dropped DLL
        
        PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5XHGhY8X.cPl

Path C:\Users\Admin\AppData\Local\Temp\5XHGhY8X.cPl
Size 2.0MB
SHA256 75b98c1ed672b120b9794e176f6d1fddfd4df1f147a77567bbb9397c780acc66
MD5 732cdda58e72f15fcc78b374f1f247f0
SHA1 f389ab367564a0d91990d4d6989e837f1da6557f
SHA512 9e49cd97fc1fe0360c9ec1fd292e6820588c68f0e7b713eac90c99f489e877b99a1bdb846d7a66dec5b13ddd84aee6a6901a4903e059f99ca47f1c99f8a87e45
SSDEEP 49152:4gvg8jEnU59nP2xrk6i1UjWaPwbul/wIknfwpANW:pTQnU5NPazi1Ujabg/3qIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

5XHghY8X.cpl

Path C:\Users\Admin\AppData\Local\Temp\5XHghY8X.cpl
Size 2.0MB
SHA256 75b98c1ed672b120b9794e176f6d1fddfd4df1f147a77567bbb9397c780acc66
MD5 732cdda58e72f15fcc78b374f1f247f0
SHA1 f389ab367564a0d91990d4d6989e837f1da6557f
SHA512 9e49cd97fc1fe0360c9ec1fd292e6820588c68f0e7b713eac90c99f489e877b99a1bdb846d7a66dec5b13ddd84aee6a6901a4903e059f99ca47f1c99f8a87e45
SSDEEP 49152:4gvg8jEnU59nP2xrk6i1UjWaPwbul/wIknfwpANW:pTQnU5NPazi1Ujabg/3qIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

5XHghY8X.cpl

Path C:\Users\Admin\AppData\Local\Temp\5XHghY8X.cpl
Size 2.0MB
SHA256 75b98c1ed672b120b9794e176f6d1fddfd4df1f147a77567bbb9397c780acc66
MD5 732cdda58e72f15fcc78b374f1f247f0
SHA1 f389ab367564a0d91990d4d6989e837f1da6557f
SHA512 9e49cd97fc1fe0360c9ec1fd292e6820588c68f0e7b713eac90c99f489e877b99a1bdb846d7a66dec5b13ddd84aee6a6901a4903e059f99ca47f1c99f8a87e45
SSDEEP 49152:4gvg8jEnU59nP2xrk6i1UjWaPwbul/wIknfwpANW:pTQnU5NPazi1Ujabg/3qIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

5XHghY8X.cpl

Path C:\Users\Admin\AppData\Local\Temp\5XHghY8X.cpl
Size 2.0MB
SHA256 75b98c1ed672b120b9794e176f6d1fddfd4df1f147a77567bbb9397c780acc66
MD5 732cdda58e72f15fcc78b374f1f247f0
SHA1 f389ab367564a0d91990d4d6989e837f1da6557f
SHA512 9e49cd97fc1fe0360c9ec1fd292e6820588c68f0e7b713eac90c99f489e877b99a1bdb846d7a66dec5b13ddd84aee6a6901a4903e059f99ca47f1c99f8a87e45
SSDEEP 49152:4gvg8jEnU59nP2xrk6i1UjWaPwbul/wIknfwpANW:pTQnU5NPazi1Ujabg/3qIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3872-11-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Download

memory/3872-14-0x0000000003380000-0x0000000003481000-memory.dmp

Download

memory/3872-15-0x0000000003490000-0x0000000003579000-memory.dmp

Download

memory/3872-18-0x0000000003490000-0x0000000003579000-memory.dmp

Download

memory/3872-19-0x0000000003490000-0x0000000003579000-memory.dmp

Download

memory/3872-12-0x0000000010000000-0x000000001020A000-memory.dmp

Download

memory/4460-21-0x0000000002460000-0x0000000002466000-memory.dmp

Download

memory/4460-24-0x0000000002C30000-0x0000000002D31000-memory.dmp

Download

memory/4460-25-0x0000000002D40000-0x0000000002E29000-memory.dmp

Download

memory/4460-28-0x0000000002D40000-0x0000000002E29000-memory.dmp

Download

memory/4460-29-0x0000000002D40000-0x0000000002E29000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads