Overview

overview

7

Static

static

3

b96622e7dc...32.exe

windows7-x64

7

b96622e7dc...32.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b96622e7dcccbab7a7dc556bdc3b2d70_exe32.exe

  • Size

    279KB

  • MD5

    b96622e7dcccbab7a7dc556bdc3b2d70

  • SHA1

    567da557cfcb7610dcab81e76492c3d6516a6bc0

  • SHA256

    937c535b83978e7fd87039b61c735de1b06f44921bc70513d9cfc8b903c29340

  • SHA512

    f85d370956b3dc8958417093637a83b54f30c74a98f8c652f24720b6444f2a2bc589f25f29bb399d52993bf7233f498a6084edb4206e33cf27bd8a937e8b517b

  • SSDEEP

    3072:R8ERv3zZZm5c4Sq+YN95wFT0z+QadjN3rOwRXENk+Y0yFNzlUu0VS:R8EZrm55Zt5wFwz+TdpRXENFTAkVS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b96622e7dcccbab7a7dc556bdc3b2d70_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\b96622e7dcccbab7a7dc556bdc3b2d70_exe32.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Users\Admin\AppData\Local\Temp\Systeamgrgng.exe
      "C:\Users\Admin\AppData\Local\Temp\Systeamgrgng.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2528

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Systeamgrgng.exe
          Filesize

          279KB

          MD5

          ec151f949cba2fa0ae4a1781eae1fa3d

          SHA1

          f12a3bb79e1e7dafa7ba42dfcdd88f448ce257e1

          SHA256

          28187ef2ce526f1f1cd37694e085a0944ff748626e1c357d4db6cb5f111d27d5

          SHA512

          0ae1c77f8c71fd8452e76cff9d6257af03ce270772af4c076fd144f2dd6277277bfa77a64ac020716ab76648217f4258b016daa1de268d3a5d0271be4ea788ca

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Systeamgrgng.exe
          Filesize

          279KB

          MD5

          ec151f949cba2fa0ae4a1781eae1fa3d

          SHA1

          f12a3bb79e1e7dafa7ba42dfcdd88f448ce257e1

          SHA256

          28187ef2ce526f1f1cd37694e085a0944ff748626e1c357d4db6cb5f111d27d5

          SHA512

          0ae1c77f8c71fd8452e76cff9d6257af03ce270772af4c076fd144f2dd6277277bfa77a64ac020716ab76648217f4258b016daa1de268d3a5d0271be4ea788ca

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Systeamgrgng.exe
          Filesize

          279KB

          MD5

          ec151f949cba2fa0ae4a1781eae1fa3d

          SHA1

          f12a3bb79e1e7dafa7ba42dfcdd88f448ce257e1

          SHA256

          28187ef2ce526f1f1cd37694e085a0944ff748626e1c357d4db6cb5f111d27d5

          SHA512

          0ae1c77f8c71fd8452e76cff9d6257af03ce270772af4c076fd144f2dd6277277bfa77a64ac020716ab76648217f4258b016daa1de268d3a5d0271be4ea788ca

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\cpath.ini
          Filesize

          76B

          MD5

          8269bced11df04e3a1fb05a52624dc69

          SHA1

          6427d5cd07cbee68ec0d27f0a96c9f4f7674f993

          SHA256

          3b3ca2a5ad4c90c8d104ded04db4d90dec31f498cb61bc6094ca9633ff970446

          SHA512

          2ab11dfc8e8016beee78a7a98999426c96b41536976a86dc8006a097e36dc8ec233dd8d81f41bc75ad1b074e551adba67be265dbccc9c7ba1511bc3f19dcd0aa

          Download Submit