e7acff90a1aa9c97969814dd2161c54e1e2634b1b6879fbade91fd2649e7b819

General

Target

SOA SETTLEMENT RECEIPT.exe
Size

684KB
MD5

b381723baa76f866458dec454fcc9829
SHA1

ca7089f9271534c664c23f641201516ddf13c81b
SHA256

e7acff90a1aa9c97969814dd2161c54e1e2634b1b6879fbade91fd2649e7b819
SHA512

632154c7e34ab69f3b8d9e5b306708a7d39fb3ff126d59be0dd7acfe3bb31d4ea97e5ea7387eb9519239137aa1e949d41ad78dca4d41eeabc8746aa0ea86eedb
SSDEEP

12288:6Ak7s9/wMgHZRZpQj0XWMzp6DZInFuwhXc0miKcwsy58urKZI1i/mmDv:Nk7s9/Vg53u0mMziZInFhhs0miKG1aij

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3986878123-1347213090-2173403696-1000\Control Panel\International\Geo\Nation	SOA SETTLEMENT RECEIPT.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2712 set thread context of 1292	2712	SOA SETTLEMENT RECEIPT.exe	7
PID 2712 set thread context of 1292	2712	SOA SETTLEMENT RECEIPT.exe	7
PID 2712 set thread context of 1288	2712	SOA SETTLEMENT RECEIPT.exe	33
PID 1288 set thread context of 2644	1288	help.exe	32

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2140	SOA SETTLEMENT RECEIPT.exe
2140	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
1288	help.exe
1288	help.exe
1288	help.exe
1288	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2712	SOA SETTLEMENT RECEIPT.exe
2712	SOA SETTLEMENT RECEIPT.exe
1292	Explorer.EXE
1292	Explorer.EXE
1288	help.exe
1288	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	SOA SETTLEMENT RECEIPT.exe
Token: SeDebugPrivilege	2712	SOA SETTLEMENT RECEIPT.exe
Token: SeDebugPrivilege	1288	help.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1720	2140	SOA SETTLEMENT RECEIPT.exe	30
PID 2140 wrote to memory of 1720	2140	SOA SETTLEMENT RECEIPT.exe	30
PID 2140 wrote to memory of 1720	2140	SOA SETTLEMENT RECEIPT.exe	30
PID 2140 wrote to memory of 1720	2140	SOA SETTLEMENT RECEIPT.exe	30
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 2140 wrote to memory of 2712	2140	SOA SETTLEMENT RECEIPT.exe	31
PID 1292 wrote to memory of 1288	1292	Explorer.EXE	33
PID 1292 wrote to memory of 1288	1292	Explorer.EXE	33
PID 1292 wrote to memory of 1288	1292	Explorer.EXE	33
PID 1292 wrote to memory of 1288	1292	Explorer.EXE	33
PID 1292 wrote to memory of 2644	1292	Explorer.EXE	32
PID 1292 wrote to memory of 2644	1292	Explorer.EXE	32
PID 1292 wrote to memory of 2644	1292	Explorer.EXE	32
PID 1292 wrote to memory of 2644	1292	Explorer.EXE	32

C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe
"C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe"
  2⤵
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA SETTLEMENT RECEIPT.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-27-0x00000000000A0000-0x00000000000D6000-memory.dmp

Filesize
216KB

Download
memory/1288-28-0x00000000000A0000-0x00000000000D6000-memory.dmp

Filesize
216KB

Download
memory/1288-31-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/1288-32-0x00000000000A0000-0x00000000000D6000-memory.dmp

Filesize
216KB

Download
memory/1288-34-0x00000000000A0000-0x00000000000D6000-memory.dmp

Filesize
216KB

Download
memory/1292-20-0x0000000008A70000-0x000000000B069000-memory.dmp

Filesize
38.0MB

Download
memory/1292-26-0x000000000B460000-0x000000000BC09000-memory.dmp

Filesize
7.7MB

Download
memory/1292-33-0x000000000B460000-0x000000000BC09000-memory.dmp

Filesize
7.7MB

Download
memory/2140-1-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-7-0x0000000004FC0000-0x000000000503A000-memory.dmp

Filesize
488KB

Download
memory/2140-6-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2140-5-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2140-13-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-4-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-3-0x0000000000640000-0x0000000000658000-memory.dmp

Filesize
96KB

Download
memory/2140-2-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2140-0-0x0000000000240000-0x00000000002F0000-memory.dmp

Filesize
704KB

Download
memory/2712-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-19-0x00000000001B0000-0x00000000001D4000-memory.dmp

Filesize
144KB

Download
memory/2712-21-0x00000000001B0000-0x00000000001D4000-memory.dmp

Filesize
144KB

Download
memory/2712-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-23-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-24-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-25-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/2712-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-30-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/2712-14-0x0000000000A50000-0x0000000000D53000-memory.dmp

Filesize
3.0MB

Download
memory/2712-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2712-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing