d47ffa12778a36d3282598931fbd4614b0215ba1643a59dfdb7e80d8fffa5ead

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
US2TZfFlHhqVLSN.exe
Size 685KB
Sample230919-twdpdace54
SHA256 d47ffa12778a36d3282598931fbd4614b0215ba1643a59dfdb7e80d8fffa5ead
MD5 b466d0d13ad453ad5b5484970b985a47
SHA1 bee2493e564e52d70ef239e45f16adf81f8269eb
SHA512 a59cf55ffc41a3b1e8f23f1be4a4478bc62c9656013ddde00bc32325b4a95b2bea36e4469237e614c614898be82a1aab3dc57ba54f90d144838375c8a3003cb3
SSDEEP 12288:op+f4mfJw1Ubv41BCGJzLux0JCp+cwSrtZ0oqtH9fJ:+gBwREGJfOnpJFqbB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Control Panel\International\Geo\Nation	US2TZfFlHhqVLSN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2728	2236	US2TZfFlHhqVLSN.exe	31

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2236	US2TZfFlHhqVLSN.exe
2236	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe
2728	US2TZfFlHhqVLSN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	US2TZfFlHhqVLSN.exe
Token: SeDebugPrivilege	2728	US2TZfFlHhqVLSN.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2712	2236	US2TZfFlHhqVLSN.exe	30
PID 2236 wrote to memory of 2712	2236	US2TZfFlHhqVLSN.exe	30
PID 2236 wrote to memory of 2712	2236	US2TZfFlHhqVLSN.exe	30
PID 2236 wrote to memory of 2712	2236	US2TZfFlHhqVLSN.exe	30
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31
PID 2236 wrote to memory of 2728	2236	US2TZfFlHhqVLSN.exe	31

C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe
"C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe
  "C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe"
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe
  "C:\Users\Admin\AppData\Local\Temp\US2TZfFlHhqVLSN.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-6-0x0000000000680000-0x000000000068A000-memory.dmp

Download

memory/2236-7-0x0000000005380000-0x00000000053F4000-memory.dmp

Download

memory/2236-2-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Download

memory/2236-3-0x00000000004B0000-0x00000000004C8000-memory.dmp

Download

memory/2236-4-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download

memory/2236-5-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Download

memory/2236-1-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download

memory/2236-13-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download

memory/2236-0-0x0000000000220000-0x00000000002D2000-memory.dmp

Download

memory/2728-9-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2728-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2728-12-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2728-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2728-14-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Download

memory/2728-15-0x0000000000400000-0x0000000000435000-memory.dmp

Download