d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe
Size 2.1MB
Sample230930-zepyzagg53
SHA256 d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a
MD5 54c6771566036ebd397c1dddf86deb93
SHA1 6139e66ab2934019ff9da4df152f76bd3ed0babe
SHA512 b0db4d18835b1c7bc4b6faaa869e98b5a38a259ddca259cf15a868413b7ecd8e40c1ff2ac7235e675bd873428a6d6e6afe13bcaf351b06e9b9a4c430743dcda0
SSDEEP 49152:ISBA9NPpJasJGl511F2vWRrgOphLAhcf1fleW:IS69NP6sJoT1DWShLAhqflB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe

Loads dropped DLL 2 IoCs

pid	Process
224	rundll32.exe
636	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2140	5004	SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe	86
PID 5004 wrote to memory of 2140	5004	SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe	86
PID 5004 wrote to memory of 2140	5004	SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe	86
PID 2140 wrote to memory of 5112	2140	cmd.exe	89
PID 2140 wrote to memory of 5112	2140	cmd.exe	89
PID 2140 wrote to memory of 5112	2140	cmd.exe	89
PID 5112 wrote to memory of 224	5112	control.exe	90
PID 5112 wrote to memory of 224	5112	control.exe	90
PID 5112 wrote to memory of 224	5112	control.exe	90
PID 224 wrote to memory of 744	224	rundll32.exe	96
PID 224 wrote to memory of 744	224	rundll32.exe	96
PID 744 wrote to memory of 636	744	RunDll32.exe	97
PID 744 wrote to memory of 636	744	RunDll32.exe	97
PID 744 wrote to memory of 636	744	RunDll32.exe	97

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.24931.29498.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z77A5238C\B23A.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\control.exe
    CONtRoL "C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVVcxIB.TE"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVVcxIB.TE"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVVcxIB.TE"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:744
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVVcxIB.TE"
        6⤵
        Loads dropped DLL
        
        PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1QVVcxIB.TE

Path C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVVcxIB.TE
Size 2.3MB
SHA256 6925ab426af7692e747b7a0741677f19800c783da357fc09afff2c6b0907fbe8
MD5 23021180e6707d6b97f41362ff30bf9f
SHA1 60c183299501fe2ed51094a31a82fef31169d856
SHA512 8247d5d66d0acb1656dddaadf132f27b333142907727d86a09ecf046730fc2408e02fe41b7a87d2347d3fca833e4513bc2e1646f1c96a77be809c90359da350a
SSDEEP 49152:+bV6amABQQhoqqsmrMhBFzrx4Muan9z23UBde6n:omABQQaumrMXFzl4MuanfP
MD5 SHA1 SHA512 SSDEEP

Submit Download

1QVvcxIB.Te

Path C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVvcxIB.Te
Size 2.3MB
SHA256 6925ab426af7692e747b7a0741677f19800c783da357fc09afff2c6b0907fbe8
MD5 23021180e6707d6b97f41362ff30bf9f
SHA1 60c183299501fe2ed51094a31a82fef31169d856
SHA512 8247d5d66d0acb1656dddaadf132f27b333142907727d86a09ecf046730fc2408e02fe41b7a87d2347d3fca833e4513bc2e1646f1c96a77be809c90359da350a
SSDEEP 49152:+bV6amABQQhoqqsmrMhBFzrx4Muan9z23UBde6n:omABQQaumrMXFzl4MuanfP
MD5 SHA1 SHA512 SSDEEP

Submit Download

1QVvcxIB.Te

Path C:\Users\Admin\AppData\Local\Temp\7z77A5238C\1QVvcxIB.Te
Size 2.3MB
SHA256 6925ab426af7692e747b7a0741677f19800c783da357fc09afff2c6b0907fbe8
MD5 23021180e6707d6b97f41362ff30bf9f
SHA1 60c183299501fe2ed51094a31a82fef31169d856
SHA512 8247d5d66d0acb1656dddaadf132f27b333142907727d86a09ecf046730fc2408e02fe41b7a87d2347d3fca833e4513bc2e1646f1c96a77be809c90359da350a
SSDEEP 49152:+bV6amABQQhoqqsmrMhBFzrx4Muan9z23UBde6n:omABQQaumrMXFzl4MuanfP
MD5 SHA1 SHA512 SSDEEP

Submit Download

B23A.bat

Path C:\Users\Admin\AppData\Local\Temp\7z77A5238C\B23A.bat
Size 27B
SHA256 13b72a6a48226c337522ba5a342c92baedb1f078ab19525682dc9ec17e15989c
MD5 9fae0e6023b4f3a65da6dd9cf39d60cd
SHA1 7c582f84c8b07be953eb6fb0f216cd94bd885a64
SHA512 474e8c135fc210477fac5c8fc66f2bbb92c45abff6223c3acd19e02be5badc7a771e05c40a20498e38a80658a940d5bba09b9d9007a402b1161e169509a548bd
MD5 SHA1 SHA512

Submit Download

memory/224-9-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

Download

memory/224-12-0x0000000003060000-0x0000000003184000-memory.dmp

Download

memory/224-13-0x00000000031A0000-0x00000000032A8000-memory.dmp

Download

memory/224-16-0x00000000031A0000-0x00000000032A8000-memory.dmp

Download

memory/224-17-0x00000000031A0000-0x00000000032A8000-memory.dmp

Download

memory/224-10-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/636-20-0x0000000002490000-0x0000000002496000-memory.dmp

Download

memory/636-22-0x0000000002B70000-0x0000000002C94000-memory.dmp

Download

memory/636-23-0x0000000002CA0000-0x0000000002DA8000-memory.dmp

Download

memory/636-26-0x0000000002CA0000-0x0000000002DA8000-memory.dmp

Download

memory/636-27-0x0000000002CA0000-0x0000000002DA8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads