ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3

General

Target

ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
Size

5.5MB
MD5

1bd38e2f797e05fb807df546c65f110b
SHA1

d4a9cce5629581ac4a58acfa2fbe84dedd4dcf42
SHA256

ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3
SHA512

352825edbf50d576363754b4fa563b408cee6f28628c7d944761d1dc27d55aaff0a0d15fdf9d70db8657277585dc2de07287076810778da97b7e42f92b9c9c4a
SSDEEP

98304:1D5v8h0AtmraaT14FuxGT96TH/k8DrW7R9H1cSFrL06ZXaOCNWDdxRZTmGcy:n8RCZTiuGETfk8DrWN9HeMrGzN4pNcy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Loads dropped DLL 1 IoCs

pid	Process
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 768	2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe	87
PID 2764 wrote to memory of 768	2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe	87
PID 2764 wrote to memory of 768	2764	ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe	87

C:\Users\Admin\AppData\Local\Temp\ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe
"C:\Users\Admin\AppData\Local\Temp\ce2c8a3de48cf38171ffccbeec8d2b12d587f1c97ae4c674f0a393cc84b13ec3.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
  2⤵
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\evb4CD4.tmp

Filesize
1KB

MD5
d6fd4e3fc2e451cfea77ad98b71031ca

SHA1
d013477a53cd9d35550ee140d0dd504a1280d37c

SHA256
3e180bed0402170c7998649fac5a6c9d3935fcf7be6604d6157626cb933f0fff

SHA512
eb854f897e3ecd2e5c27af593ce40af554951d5d5f72173e14bb123963ffeafce063ce51dca10431d565ca05269b795a6fc49b33c4852ab47f2ff43677960f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\tem.vbs

Filesize
275B

MD5
081bd1c13406d9d8ae6ccc10a1465e4e

SHA1
9ba43c2b89991ad97edd2d901180e1ff87760217

SHA256
69bb115b4ec17c69db4a8ef27f2c567e3e0670735a18ee00309b376c0adcb520

SHA512
dab6228d1a1c471244dd6e16a5c92de12a30306ec548dff6c0dad7f8f23e02c077ddc8ed8416ab4dd39bed8efc5cb44c253f29ef708de0c859400f92a52a0f0c

Download Submit
memory/2764-9-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2764-12-0x0000000001100000-0x0000000001101000-memory.dmp

Filesize
4KB

Download
memory/2764-5-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-6-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/2764-4-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/2764-7-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2764-8-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-11-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/2764-0-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-3-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-13-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2764-14-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-1-0x0000000077982000-0x0000000077983000-memory.dmp

Filesize
4KB

Download
memory/2764-20-0x0000000010000000-0x0000000010189000-memory.dmp

Filesize
1.5MB

Download
memory/2764-2-0x0000000077983000-0x0000000077984000-memory.dmp

Filesize
4KB

Download
memory/2764-29-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-31-0x0000000000400000-0x0000000000C94000-memory.dmp

Filesize
8.6MB

Download
memory/2764-32-0x0000000010000000-0x0000000010189000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing