1369e2566772026aa4aac1742987ddb70daadd8cd58d0e71e31b219657d9545a

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2023, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.2MB
Sample231208-gcvsbshd93
SHA256 1369e2566772026aa4aac1742987ddb70daadd8cd58d0e71e31b219657d9545a
MD5 1dcd373721b559a276280b1e63491635
SHA1 a1d75e8204b43114c4a2124c778db02cddfe9b0c
SHA512 70d8a841505f25cb368b7872cc16175bc178e7dd2d14fa4f895f0304e09b7c28f18b6e5513f7b3e40e7808345fa2fc1383f2f53f618af5e465e5c2750fa1e400
SSDEEP 49152:B8G/M37/HyHUTgvEcalqjWiyJ61UWD0IdxWozu1QA52ZgeDPGti8bdJFqaenR:B8GGHllpSUWD0kxnS1QA2LZ87FqaeR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	rundll32.exe
5096	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 432	2260	file.exe	89
PID 2260 wrote to memory of 432	2260	file.exe	89
PID 2260 wrote to memory of 432	2260	file.exe	89
PID 432 wrote to memory of 4380	432	cmd.exe	91
PID 432 wrote to memory of 4380	432	cmd.exe	91
PID 432 wrote to memory of 4380	432	cmd.exe	91
PID 4380 wrote to memory of 2292	4380	control.exe	93
PID 4380 wrote to memory of 2292	4380	control.exe	93
PID 4380 wrote to memory of 2292	4380	control.exe	93
PID 2292 wrote to memory of 3624	2292	rundll32.exe	99
PID 2292 wrote to memory of 3624	2292	rundll32.exe	99
PID 3624 wrote to memory of 5096	3624	RunDll32.exe	100
PID 3624 wrote to memory of 5096	3624	RunDll32.exe	100
PID 3624 wrote to memory of 5096	3624	RunDll32.exe	100

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\q_.Cmd
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3624
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL",
        6⤵
        Loads dropped DLL
        
        PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b1uga.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL
Size 4.1MB
SHA256 2b3bf49f7cf0551bcbcbcd552ceb23b65269bd4e84917a0c4b704518dd58362d
MD5 fd8924832ac45d0b853325078da3aada
SHA1 8caf6d32e7545d5eb35db642459d2f890525e8d5
SHA512 a9d04e3f6e45bc7d8cd38f4a1a8dcab8948cd0bb69ff5d79e913acd2b96368fec5e67044bc080df0a29423fd48559b8f279c56abc7caa16bca387f4143baa879
SSDEEP 49152:zJ7aHS0U1goEcqlr0/v9H11FZF5cBG298Kzg1QgOvoVGQy8UvJJqffnI:sHrlyFFZFWBG2u6g1QgOW28CJqff
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1uga.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL
Size 4.1MB
SHA256 2b3bf49f7cf0551bcbcbcd552ceb23b65269bd4e84917a0c4b704518dd58362d
MD5 fd8924832ac45d0b853325078da3aada
SHA1 8caf6d32e7545d5eb35db642459d2f890525e8d5
SHA512 a9d04e3f6e45bc7d8cd38f4a1a8dcab8948cd0bb69ff5d79e913acd2b96368fec5e67044bc080df0a29423fd48559b8f279c56abc7caa16bca387f4143baa879
SSDEEP 49152:zJ7aHS0U1goEcqlr0/v9H11FZF5cBG298Kzg1QgOvoVGQy8UvJJqffnI:sHrlyFFZFWBG2u6g1QgOW28CJqff
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1uga.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\b1uga.cPL
Size 4.1MB
SHA256 2b3bf49f7cf0551bcbcbcd552ceb23b65269bd4e84917a0c4b704518dd58362d
MD5 fd8924832ac45d0b853325078da3aada
SHA1 8caf6d32e7545d5eb35db642459d2f890525e8d5
SHA512 a9d04e3f6e45bc7d8cd38f4a1a8dcab8948cd0bb69ff5d79e913acd2b96368fec5e67044bc080df0a29423fd48559b8f279c56abc7caa16bca387f4143baa879
SSDEEP 49152:zJ7aHS0U1goEcqlr0/v9H11FZF5cBG298Kzg1QgOvoVGQy8UvJJqffnI:sHrlyFFZFWBG2u6g1QgOW28CJqff
MD5 SHA1 SHA512 SSDEEP

Submit Download

q_.Cmd

Path C:\Users\Admin\AppData\Local\Temp\7zS4D8A6BC7\q_.Cmd
Size 39B
SHA256 5e26b554b78523d62cb2287d29e2b09e705a4a1922bfe312e6924094fbee18f0
MD5 7ff68a7fee3cd950b246186212782d4e
SHA1 0571a4da47c4836c3abbd5d1e878318cf462139a
SHA512 e7692ab2ad1964f8539e452838a35a60f397aeac65b69dc0e204c5ca2de1bfee5e9a3e8c6a8ecb5007d4398ce132dc2087c614b0d1f6f9e372eeaf54788f4c85
MD5 SHA1 SHA512

Submit Download

memory/2292-8-0x0000000002D40000-0x0000000002D46000-memory.dmp

Download

memory/2292-11-0x0000000003630000-0x0000000003773000-memory.dmp

Download

memory/2292-12-0x0000000002D60000-0x0000000002E87000-memory.dmp

Download

memory/2292-15-0x0000000002D60000-0x0000000002E87000-memory.dmp

Download

memory/2292-16-0x0000000002D60000-0x0000000002E87000-memory.dmp

Download

memory/2292-9-0x0000000010000000-0x0000000010418000-memory.dmp

Download

memory/5096-19-0x0000000001280000-0x0000000001286000-memory.dmp

Download

memory/5096-21-0x0000000003410000-0x0000000003553000-memory.dmp

Download

memory/5096-22-0x0000000003560000-0x0000000003687000-memory.dmp

Download

memory/5096-25-0x0000000003560000-0x0000000003687000-memory.dmp

Download

memory/5096-26-0x0000000003560000-0x0000000003687000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads