Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe
Resource
win10v2004-20230915-en
General
-
Target
353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe
-
Size
3.0MB
-
MD5
e5ed85d713e30d1aedf3fdcb9ab7f821
-
SHA1
73977dd451eb058aa193258d164ef687fdac66d6
-
SHA256
353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13
-
SHA512
124ee5d262b695d1ebe83671c0775bb216cbf710bb1b3c5eff27097c37901fdf2d59c34e0473de1ad54313a53db1328b2b3c5e835b59acf47209b9623ba7cdb5
-
SSDEEP
49152:nIL2ZLYeqIbhmsamf8GCPok9N8auySmhFlPqD3SHQbMHsSmo85P52A+:n/KvsaaCgkYauySm5PqDmfJ8Jj+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation 353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe -
Loads dropped DLL 2 IoCs
pid Process 2172 rundll32.exe 2304 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings 353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4400 wrote to memory of 1912 4400 353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe 83 PID 4400 wrote to memory of 1912 4400 353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe 83 PID 4400 wrote to memory of 1912 4400 353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe 83 PID 1912 wrote to memory of 2172 1912 control.exe 85 PID 1912 wrote to memory of 2172 1912 control.exe 85 PID 1912 wrote to memory of 2172 1912 control.exe 85 PID 2172 wrote to memory of 4208 2172 rundll32.exe 89 PID 2172 wrote to memory of 4208 2172 rundll32.exe 89 PID 4208 wrote to memory of 2304 4208 RunDll32.exe 90 PID 4208 wrote to memory of 2304 4208 RunDll32.exe 90 PID 4208 wrote to memory of 2304 4208 RunDll32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe"C:\Users\Admin\AppData\Local\Temp\353a283be11ade473c55c9308e8e89d0efd86813aaa5b1817ec2e5d464158a13.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\nbSJOIXw.cPL",2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\nbSJOIXw.cPL",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\nbSJOIXw.cPL",4⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\nbSJOIXw.cPL",5⤵
- Loads dropped DLL
PID:2304
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5334f361b1562c66e3b2b19eaa6d2a222
SHA107d5dc27f2eb057f0aaed91c5288ab2aff3ff9cb
SHA256b093fcdfd63ab8cb0330f8660bb2cb4a8b60797ce86813f34c156a5b51ea9182
SHA51212edba08e123a9aa3bb5feb4753cf4d38ca7746254436a8f22a43f125f86ae276949645520ca35122c41a2cb216f22631112b9c04db278ec7f25d0e6c0594625
-
Filesize
2.7MB
MD5334f361b1562c66e3b2b19eaa6d2a222
SHA107d5dc27f2eb057f0aaed91c5288ab2aff3ff9cb
SHA256b093fcdfd63ab8cb0330f8660bb2cb4a8b60797ce86813f34c156a5b51ea9182
SHA51212edba08e123a9aa3bb5feb4753cf4d38ca7746254436a8f22a43f125f86ae276949645520ca35122c41a2cb216f22631112b9c04db278ec7f25d0e6c0594625
-
Filesize
2.7MB
MD5334f361b1562c66e3b2b19eaa6d2a222
SHA107d5dc27f2eb057f0aaed91c5288ab2aff3ff9cb
SHA256b093fcdfd63ab8cb0330f8660bb2cb4a8b60797ce86813f34c156a5b51ea9182
SHA51212edba08e123a9aa3bb5feb4753cf4d38ca7746254436a8f22a43f125f86ae276949645520ca35122c41a2cb216f22631112b9c04db278ec7f25d0e6c0594625
-
Filesize
2.7MB
MD5334f361b1562c66e3b2b19eaa6d2a222
SHA107d5dc27f2eb057f0aaed91c5288ab2aff3ff9cb
SHA256b093fcdfd63ab8cb0330f8660bb2cb4a8b60797ce86813f34c156a5b51ea9182
SHA51212edba08e123a9aa3bb5feb4753cf4d38ca7746254436a8f22a43f125f86ae276949645520ca35122c41a2cb216f22631112b9c04db278ec7f25d0e6c0594625