4523c6afcb7c87ba12cc2de09d64ef43a56aebea9b04b0c10aa011e9180b000e

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2023, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.0MB
Sample231208-v4vtasdaf3
SHA256 4523c6afcb7c87ba12cc2de09d64ef43a56aebea9b04b0c10aa011e9180b000e
MD5 8fa20feddfbe6a540e99e702de66d9a0
SHA1 eccfe37f43bf1a98c7f2baa6e16283ac0b92268f
SHA512 b885bba6be1e277ab368f7581d4309c61b231dae0648f469fbfe902aa71ae54f450b4226f6c1e7d0a6602462b92f6949e6cc6691ac2d2176556ba0fb3baed0fa
SSDEEP 98304:WDuFi0u+TGo/AYsOpCKXQhSVkbfWjE/WeJYDkYLyn:WDu9Go//5QXjW6JYVLyn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
3012	rundll32.exe
4604	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2772	4736	file.exe	87
PID 4736 wrote to memory of 2772	4736	file.exe	87
PID 4736 wrote to memory of 2772	4736	file.exe	87
PID 2772 wrote to memory of 5056	2772	cmd.exe	91
PID 2772 wrote to memory of 5056	2772	cmd.exe	91
PID 2772 wrote to memory of 5056	2772	cmd.exe	91
PID 5056 wrote to memory of 3012	5056	control.exe	93
PID 5056 wrote to memory of 3012	5056	control.exe	93
PID 5056 wrote to memory of 3012	5056	control.exe	93
PID 3012 wrote to memory of 1472	3012	rundll32.exe	100
PID 3012 wrote to memory of 1472	3012	rundll32.exe	100
PID 1472 wrote to memory of 4604	1472	RunDll32.exe	101
PID 1472 wrote to memory of 4604	1472	RunDll32.exe	101
PID 1472 wrote to memory of 4604	1472	RunDll32.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\bSzA_xaz.cmD
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL",
        6⤵
        Loads dropped DLL
        
        PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2gNGF.CPL

Path C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL
Size 3.9MB
SHA256 45454d399de5babcbfbb2b43e8e57836fd090f748ffd09bbac0cf51fee77a787
MD5 d7018e94b8fa9ac49eb72e956691ad49
SHA1 998c7a6d989a6fcec1d1cbde3e4618473fe19c3c
SHA512 d01120be31f1958a5f82a2bf38c04b2c2854eb34a817cecc19ec28e1d25ae7f9d927516cf95a4fb844599d06d369b4310ebfb0640d8762bec8897197018bf0ca
SSDEEP 49152:UN/s8ixHa1M8WZA67NCrfL56+Nt5e9blPAxKOCrsCtnZbc2G6x/qkwcyz:Upw6ikfLIg5qbXrhpEuqkXyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

2gNGF.CPL

Path C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL
Size 3.9MB
SHA256 45454d399de5babcbfbb2b43e8e57836fd090f748ffd09bbac0cf51fee77a787
MD5 d7018e94b8fa9ac49eb72e956691ad49
SHA1 998c7a6d989a6fcec1d1cbde3e4618473fe19c3c
SHA512 d01120be31f1958a5f82a2bf38c04b2c2854eb34a817cecc19ec28e1d25ae7f9d927516cf95a4fb844599d06d369b4310ebfb0640d8762bec8897197018bf0ca
SSDEEP 49152:UN/s8ixHa1M8WZA67NCrfL56+Nt5e9blPAxKOCrsCtnZbc2G6x/qkwcyz:Upw6ikfLIg5qbXrhpEuqkXyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

2gNGF.CPL

Path C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\2gNGF.CPL
Size 3.9MB
SHA256 45454d399de5babcbfbb2b43e8e57836fd090f748ffd09bbac0cf51fee77a787
MD5 d7018e94b8fa9ac49eb72e956691ad49
SHA1 998c7a6d989a6fcec1d1cbde3e4618473fe19c3c
SHA512 d01120be31f1958a5f82a2bf38c04b2c2854eb34a817cecc19ec28e1d25ae7f9d927516cf95a4fb844599d06d369b4310ebfb0640d8762bec8897197018bf0ca
SSDEEP 49152:UN/s8ixHa1M8WZA67NCrfL56+Nt5e9blPAxKOCrsCtnZbc2G6x/qkwcyz:Upw6ikfLIg5qbXrhpEuqkXyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bSZa_Xaz.cmd

Path C:\Users\Admin\AppData\Local\Temp\7zS08238FD7\bSZa_Xaz.cmd
Size 34B
SHA256 3db63497e4c8a246a9ed0621830029dfbf8d7a98d39841c874105baf1d4a13c4
MD5 da0e308b997901f1f99bd414d206a5ed
SHA1 0e42508d3a23fa0d580e9f7549c0d9c93dc6b133
SHA512 932cc6d98fbaa9de24702a99d6f227559896058f887eb13711afc47c26434c08930dcd9ea7690a355916e6b2a4ca711acf78819f66cb43b5d637d3e1b484b3d2
MD5 SHA1 SHA512

Submit Download

memory/3012-15-0x0000000002C30000-0x0000000002D3D000-memory.dmp

Download

memory/3012-11-0x0000000002B00000-0x0000000002C29000-memory.dmp

Download

memory/3012-13-0x0000000002C30000-0x0000000002D3D000-memory.dmp

Download

memory/3012-12-0x0000000002C30000-0x0000000002D3D000-memory.dmp

Download

memory/3012-9-0x0000000010000000-0x00000000103DA000-memory.dmp

Download

memory/3012-16-0x0000000002C30000-0x0000000002D3D000-memory.dmp

Download

memory/3012-8-0x0000000000720000-0x0000000000726000-memory.dmp

Download

memory/4604-18-0x0000000000E30000-0x0000000000E36000-memory.dmp

Download

memory/4604-21-0x0000000000E40000-0x0000000000F69000-memory.dmp

Download

memory/4604-23-0x0000000002B10000-0x0000000002C1D000-memory.dmp

Download

memory/4604-25-0x0000000002B10000-0x0000000002C1D000-memory.dmp

Download

memory/4604-26-0x0000000002B10000-0x0000000002C1D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads