2b8402a6d1df46d0d72f10101aa521119d098e9df187c8ac36ba0618b56be2e0

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xrLXOb0ukBAK.exe
Size 483KB
Sample231121-b89ngabd97
SHA256 2b8402a6d1df46d0d72f10101aa521119d098e9df187c8ac36ba0618b56be2e0
MD5 97e4cb2532bc38d6b92b6a0481f5cd9e
SHA1 242d67cde40e160727564b3d3ca9d06966e0b9ea
SHA512 e786b848934a46387bd41fd2190a5899e770d9a8262d094e512c35f78248cfaa651c1fd791916298d6b894e67b417dbe1438fb13435be32647252ca59174997a
SSDEEP 6144:m/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7L7ov:m/uPq3AfK496Gw0lwGXN3pvs/Zum8v
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	xrLXOb0ukBAK.exe

Deletes itself 1 IoCs

pid	Process
3332	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	xrLXOb0ukBAK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3332	2980	xrLXOb0ukBAK.exe	100
PID 2980 wrote to memory of 3332	2980	xrLXOb0ukBAK.exe	100
PID 2980 wrote to memory of 3332	2980	xrLXOb0ukBAK.exe	100

C:\Users\Admin\AppData\Local\Temp\xrLXOb0ukBAK.exe
"C:\Users\Admin\AppData\Local\Temp\xrLXOb0ukBAK.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ykdnuvtyebqbtauzgw.vbs"
  2⤵
  - Deletes itself
  PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ykdnuvtyebqbtauzgw.vbs

Path C:\Users\Admin\AppData\Local\Temp\ykdnuvtyebqbtauzgw.vbs
Size 520B
SHA256 0777a0870f208b7ae2a4882776d4451f9204b0c7a7c74cf7ef63706ac2150f54
MD5 d592bbbf7edf790e9296a85049028b20
SHA1 05744ec7f2d61c1b1370ff1c1321c0bbb912f3af
SHA512 dfac5207cf3b48c4a26b33e57e51b10273fb7ce12df1bb4198617bc2443010f2afcc411a6b1c72dc1aad3c503aeca533285f8352bea0708f1072bd779ff265b1
MD5 SHA1 SHA512

Submit Download