5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe
Size

2.0MB
MD5

fc59c6ba39946ca20b5aba3757723e30
SHA1

a390aca4e1d05431467f3401ff1c8a8a7745440f
SHA256

5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc
SHA512

1ff91a9429ed99ff85b6535c3ef3325fb359d308053bdd6f5b169b6f6da6bc83d876822d4251ebdc1405895ccf733983e8b923c6043b78f3a111ad83b499812d
SSDEEP

49152:xWhlkLBfJXAEXmTVUnGpyNuDCWu032AZiiJmoOk:xWhl0BfKE2TV/pyuDCWuM2AZiYm1k

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe

Loads dropped DLL 1 IoCs

pid	Process
3280	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 3280	1560	5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe	83
PID 1560 wrote to memory of 3280	1560	5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe	83
PID 1560 wrote to memory of 3280	1560	5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe	83

C:\Users\Admin\AppData\Local\Temp\5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe
"C:\Users\Admin\AppData\Local\Temp\5e1fad1e14214bce3dd50e290e87ea01168d3a81091e5a7bc8425e8b77a218bc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s N7o47.uK /u
  2⤵
  - Loads dropped DLL
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\N7o47.uK

Filesize
1.4MB

MD5
24e7e75cab8a75515cf7e3bb7b8af347

SHA1
cd80b5d8873fbe8761dfc0efe6f85c914b1aa0b7

SHA256
acff6e0610226d7fd1c22db0297aceb426d8ccdf2cd28135d2370ec70563fc43

SHA512
cdd857ec69df9d6688397b2f838477d9958d728f38eabf52e4d343dac3d37ffa3ca5bf93504bd25e7480a11e391ee60b1bf9a7ec99f168ad6c4f3a3fbf6f757a

Download Submit
C:\Users\Admin\AppData\Local\Temp\N7o47.uK

Filesize
1.4MB

MD5
24e7e75cab8a75515cf7e3bb7b8af347

SHA1
cd80b5d8873fbe8761dfc0efe6f85c914b1aa0b7

SHA256
acff6e0610226d7fd1c22db0297aceb426d8ccdf2cd28135d2370ec70563fc43

SHA512
cdd857ec69df9d6688397b2f838477d9958d728f38eabf52e4d343dac3d37ffa3ca5bf93504bd25e7480a11e391ee60b1bf9a7ec99f168ad6c4f3a3fbf6f757a

Download Submit
memory/3280-5-0x0000000010000000-0x0000000010164000-memory.dmp

Filesize
1.4MB

Download
memory/3280-4-0x0000000000DD0000-0x0000000000DD6000-memory.dmp

Filesize
24KB

Download
memory/3280-7-0x0000000002A50000-0x0000000002B49000-memory.dmp

Filesize
996KB

Download
memory/3280-8-0x0000000002B50000-0x0000000002C30000-memory.dmp

Filesize
896KB

Download
memory/3280-11-0x0000000002B50000-0x0000000002C30000-memory.dmp

Filesize
896KB

Download
memory/3280-12-0x0000000002B50000-0x0000000002C30000-memory.dmp

Filesize
896KB

Download