56f15cf68dbe3cb2e751a5b82b206ce127695ce63c31c442773d45cdbd89b496

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2023, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f88b9ae0fe7903ba4f24f0ed5de67c5.exe
Size 2.7MB
Sample230916-nyfc4aab9w
SHA256 56f15cf68dbe3cb2e751a5b82b206ce127695ce63c31c442773d45cdbd89b496
MD5 9f88b9ae0fe7903ba4f24f0ed5de67c5
SHA1 ba2c2442644473bfec02e9c05abf9992e011a14e
SHA512 ed0201d431777db69d1838e1303ba17c234dd1a11d114373996150b9c7ae55f849f383b8b0a3a75411ef378a1ca906e3777e7e0478c5db6fae73fe84a4d53039
SSDEEP 49152:acbz6gQjfbaqO2L9SH1Vrg5RHkzx5YDuHfhemBaREzjVfsMMd1zD:acbPQCRS9Wg5REOuHf9zBEn13
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe

Loads dropped DLL 2 IoCs

pid	Process
1656	rundll32.exe
3768	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4524	3204	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe	84
PID 3204 wrote to memory of 4524	3204	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe	84
PID 3204 wrote to memory of 4524	3204	9f88b9ae0fe7903ba4f24f0ed5de67c5.exe	84
PID 4524 wrote to memory of 1656	4524	control.exe	86
PID 4524 wrote to memory of 1656	4524	control.exe	86
PID 4524 wrote to memory of 1656	4524	control.exe	86
PID 1656 wrote to memory of 364	1656	rundll32.exe	89
PID 1656 wrote to memory of 364	1656	rundll32.exe	89
PID 364 wrote to memory of 3768	364	RunDll32.exe	90
PID 364 wrote to memory of 3768	364	RunDll32.exe	90
PID 364 wrote to memory of 3768	364	RunDll32.exe	90

C:\Users\Admin\AppData\Local\Temp\9f88b9ae0fe7903ba4f24f0ed5de67c5.exe
"C:\Users\Admin\AppData\Local\Temp\9f88b9ae0fe7903ba4f24f0ed5de67c5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0C6L3.cPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0C6L3.cPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0C6L3.cPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\0C6L3.cPl",
        5⤵
        Loads dropped DLL
        
        PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0C6L3.cPl

Path C:\Users\Admin\AppData\Local\Temp\0C6L3.cPl
Size 2.7MB
SHA256 6b08e4c932e76ced158b8d474b57327597c3889f519f5cfe96bb7d07f67c6e2b
MD5 1520885263be005f93dd29c815d60512
SHA1 9d71042e013d116d6072e91695ef181740d3e6fc
SHA512 d393416274f095ed614632d2d6f6a4d0666329030304b310c331f4921a97d646a08db8523e654436543865e0edcb5789b7f8f2952ea0b867e2521e65478316f8
SSDEEP 49152:f9voilHbQqe8rxSHpn1erjTYzz5YOfXemLgrEpjz7sEKFd:TqDAxOerj0HfJpnobd
MD5 SHA1 SHA512 SSDEEP

Submit Download

0C6L3.cpl

Path C:\Users\Admin\AppData\Local\Temp\0C6L3.cpl
Size 2.7MB
SHA256 6b08e4c932e76ced158b8d474b57327597c3889f519f5cfe96bb7d07f67c6e2b
MD5 1520885263be005f93dd29c815d60512
SHA1 9d71042e013d116d6072e91695ef181740d3e6fc
SHA512 d393416274f095ed614632d2d6f6a4d0666329030304b310c331f4921a97d646a08db8523e654436543865e0edcb5789b7f8f2952ea0b867e2521e65478316f8
SSDEEP 49152:f9voilHbQqe8rxSHpn1erjTYzz5YOfXemLgrEpjz7sEKFd:TqDAxOerj0HfJpnobd
MD5 SHA1 SHA512 SSDEEP

Submit Download

0C6L3.cpl

Path C:\Users\Admin\AppData\Local\Temp\0C6L3.cpl
Size 2.7MB
SHA256 6b08e4c932e76ced158b8d474b57327597c3889f519f5cfe96bb7d07f67c6e2b
MD5 1520885263be005f93dd29c815d60512
SHA1 9d71042e013d116d6072e91695ef181740d3e6fc
SHA512 d393416274f095ed614632d2d6f6a4d0666329030304b310c331f4921a97d646a08db8523e654436543865e0edcb5789b7f8f2952ea0b867e2521e65478316f8
SSDEEP 49152:f9voilHbQqe8rxSHpn1erjTYzz5YOfXemLgrEpjz7sEKFd:TqDAxOerj0HfJpnobd
MD5 SHA1 SHA512 SSDEEP

Submit Download

0C6L3.cpl

Path C:\Users\Admin\AppData\Local\Temp\0C6L3.cpl
Size 2.7MB
SHA256 6b08e4c932e76ced158b8d474b57327597c3889f519f5cfe96bb7d07f67c6e2b
MD5 1520885263be005f93dd29c815d60512
SHA1 9d71042e013d116d6072e91695ef181740d3e6fc
SHA512 d393416274f095ed614632d2d6f6a4d0666329030304b310c331f4921a97d646a08db8523e654436543865e0edcb5789b7f8f2952ea0b867e2521e65478316f8
SSDEEP 49152:f9voilHbQqe8rxSHpn1erjTYzz5YOfXemLgrEpjz7sEKFd:TqDAxOerj0HfJpnobd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1656-17-0x0000000003120000-0x0000000003219000-memory.dmp

Download

memory/1656-14-0x0000000003000000-0x0000000003115000-memory.dmp

Download

memory/1656-15-0x0000000010000000-0x00000000102B8000-memory.dmp

Download

memory/1656-16-0x0000000003120000-0x0000000003219000-memory.dmp

Download

memory/1656-12-0x0000000010000000-0x00000000102B8000-memory.dmp

Download

memory/1656-19-0x0000000003120000-0x0000000003219000-memory.dmp

Download

memory/1656-20-0x0000000003120000-0x0000000003219000-memory.dmp

Download

memory/1656-11-0x0000000000E90000-0x0000000000E96000-memory.dmp

Download

memory/3768-22-0x0000000000A70000-0x0000000000A76000-memory.dmp

Download

memory/3768-26-0x0000000002B40000-0x0000000002C55000-memory.dmp

Download

memory/3768-28-0x0000000002C60000-0x0000000002D59000-memory.dmp

Download

memory/3768-30-0x0000000002C60000-0x0000000002D59000-memory.dmp

Download

memory/3768-31-0x0000000002C60000-0x0000000002D59000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads