Analysis

  • max time kernel
    3s
  • max time network
    10s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2023 09:07

General

  • Target

    SBLlgcMqPg.exe

  • Size

    692KB

  • MD5

    b5c9e88f297775547ca77953f4eee2ca

  • SHA1

    835f2f087d9a740d656b676ce2007db9512ff06d

  • SHA256

    d64f2f04a0c31f0f3ee4cc14722eeb14b8f5af917e8d8e1b3a4dc9eb2ce06229

  • SHA512

    b75011c586bab6ac51692833b0ac0c051d68eba74baf473a0c788d81067de309671de57631a6f2a87f6d5d3b896b389c36754eb1b6cf980dcdf9b276b35fc438

  • SSDEEP

    12288:auq+qEN+gwB4lmjNyjW/GM/emM17CbU67RMklDia0zR5:auBqEI7kXjsJe1ubv7RMcDJ0z

Score
10/10

Malware Config

Signatures

  • Windows security bypass 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SBLlgcMqPg.exe
    "C:\Users\Admin\AppData\Local\Temp\SBLlgcMqPg.exe"
    1⤵
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Suspicious use of WriteProcessMemory
    PID:456
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SBLlgcMqPg.exe" -Force
      2⤵
        PID:2320

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Impair Defenses

    2
    T1562

    Disable or Modify Tools

    2
    T1562.001

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/456-0-0x0000000074720000-0x0000000074ED0000-memory.dmp
      Filesize

      7.7MB

    • memory/456-1-0x0000000000080000-0x0000000000134000-memory.dmp
      Filesize

      720KB

    • memory/456-2-0x0000000004B40000-0x0000000004BDC000-memory.dmp
      Filesize

      624KB

    • memory/456-3-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
      Filesize

      64KB

    • memory/456-4-0x0000000004BE0000-0x0000000004C90000-memory.dmp
      Filesize

      704KB

    • memory/456-5-0x0000000004AF0000-0x0000000004B0A000-memory.dmp
      Filesize

      104KB

    • memory/456-6-0x0000000005280000-0x0000000005824000-memory.dmp
      Filesize

      5.6MB