926e196d0fcbeb0c40b8e6237f87344ef7c62c7ed67fba6dbfbcf1b6d7d5c1c5

Analysis

max time kernel
103s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2023, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.8MB
Sample231209-qech7sabf4
SHA256 926e196d0fcbeb0c40b8e6237f87344ef7c62c7ed67fba6dbfbcf1b6d7d5c1c5
MD5 8f11b5e539421e8a0664a60902887d15
SHA1 9ebc23de1f86c515c1b8a24146724c77555514f9
SHA512 da2b3af9d70e31d72570b921fc664ff7782e34fed551ecdbd43d554ebe803b9f57730219d11b06152cdeb053a2ad2f3a0131a2183e5e1af1ae0d12da0c1f3e13
SSDEEP 49152:B8OPOXdTlwFbxvc5pGnPukMbk7htrqsGrt75XVQ1tD8XTQ6F+8QRLxmK95k2IPs:B82uxQo6Pdb14sc75RQRLp9gs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2432	rundll32.exe
4256	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 932	872	file.exe	89
PID 872 wrote to memory of 932	872	file.exe	89
PID 872 wrote to memory of 932	872	file.exe	89
PID 932 wrote to memory of 2772	932	cmd.exe	92
PID 932 wrote to memory of 2772	932	cmd.exe	92
PID 932 wrote to memory of 2772	932	cmd.exe	92
PID 2772 wrote to memory of 2432	2772	control.exe	94
PID 2772 wrote to memory of 2432	2772	control.exe	94
PID 2772 wrote to memory of 2432	2772	control.exe	94
PID 2432 wrote to memory of 3100	2432	rundll32.exe	97
PID 2432 wrote to memory of 3100	2432	rundll32.exe	97
PID 3100 wrote to memory of 4256	3100	RunDll32.exe	98
PID 3100 wrote to memory of 4256	3100	RunDll32.exe	98
PID 3100 wrote to memory of 4256	3100	RunDll32.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\Q.bAT
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3100
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL",
        6⤵
        Loads dropped DLL
        
        PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7g.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL
Size 3.0MB
SHA256 9095b94aa34384745896406132dee04ca506e75f49d168aec8d7ab9ae115949b
MD5 4ddde833849eca7487895d63a0e3ec42
SHA1 80e0aeb492ae8615b52b8103a9649f7960f166bc
SHA512 74dbd2320862b875ef37ac3c7e7eedcbc74644e3e02c0661ae70a10bf11ec08f247548a48919ab4d8b15042a8b2f6a61e6a84273c89a1a4b8469dff963bbe908
SSDEEP 49152:chimZeJIW0hI2o8Hdlqz4tyttemzGBFtgrnqa2PBqe/:PmEDY9JyuFtgmNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

7g.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL
Size 3.0MB
SHA256 9095b94aa34384745896406132dee04ca506e75f49d168aec8d7ab9ae115949b
MD5 4ddde833849eca7487895d63a0e3ec42
SHA1 80e0aeb492ae8615b52b8103a9649f7960f166bc
SHA512 74dbd2320862b875ef37ac3c7e7eedcbc74644e3e02c0661ae70a10bf11ec08f247548a48919ab4d8b15042a8b2f6a61e6a84273c89a1a4b8469dff963bbe908
SSDEEP 49152:chimZeJIW0hI2o8Hdlqz4tyttemzGBFtgrnqa2PBqe/:PmEDY9JyuFtgmNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

7g.cPL

Path C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\7g.cPL
Size 3.0MB
SHA256 9095b94aa34384745896406132dee04ca506e75f49d168aec8d7ab9ae115949b
MD5 4ddde833849eca7487895d63a0e3ec42
SHA1 80e0aeb492ae8615b52b8103a9649f7960f166bc
SHA512 74dbd2320862b875ef37ac3c7e7eedcbc74644e3e02c0661ae70a10bf11ec08f247548a48919ab4d8b15042a8b2f6a61e6a84273c89a1a4b8469dff963bbe908
SSDEEP 49152:chimZeJIW0hI2o8Hdlqz4tyttemzGBFtgrnqa2PBqe/:PmEDY9JyuFtgmNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

q.BAT

Path C:\Users\Admin\AppData\Local\Temp\7zS863B1C77\q.BAT
Size 57B
SHA256 8c5fa35bbc75468658955504f3512393e0be2fea58d74c1d2fa8f62cbe7b0c76
MD5 c8b4e4eac388deb1ccb6211ef7847c18
SHA1 4094fc52c43499e6d6faab6f9aff2458a8cb4154
SHA512 b657ac8dd271eb872dcc163c11339f90f6c0575ce365cd75410512d81e7a0356db84d9cbf92202a7683807c90a9852f6ae16cbfc7cb523b777f15d21754b2c0b
MD5 SHA1 SHA512

Submit Download

memory/2432-19-0x0000000003FD0000-0x00000000040C9000-memory.dmp

Download

memory/2432-47-0x00000000040D0000-0x00000000041C8000-memory.dmp

Download

memory/2432-12-0x0000000002A00000-0x0000000002B04000-memory.dmp

Download

memory/2432-13-0x0000000002A00000-0x0000000002B04000-memory.dmp

Download

memory/2432-15-0x0000000002A00000-0x0000000002B04000-memory.dmp

Download

memory/2432-16-0x0000000010000000-0x00000000102FE000-memory.dmp

Download

memory/2432-17-0x0000000002A00000-0x0000000002B04000-memory.dmp

Download

memory/2432-18-0x0000000002B10000-0x0000000003FCD000-memory.dmp

Download

memory/2432-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Download

memory/2432-20-0x00000000040D0000-0x00000000041C8000-memory.dmp

Download

memory/2432-9-0x0000000010000000-0x00000000102FE000-memory.dmp

Download

memory/2432-11-0x00000000028D0000-0x00000000029F1000-memory.dmp

Download

memory/2432-48-0x0000000000170000-0x0000000000182000-memory.dmp

Download

memory/4256-25-0x00000000026E0000-0x00000000026E6000-memory.dmp

Download

memory/4256-31-0x0000000002970000-0x0000000002A74000-memory.dmp

Download

memory/4256-33-0x0000000002970000-0x0000000002A74000-memory.dmp

Download

memory/4256-35-0x0000000003F40000-0x0000000004039000-memory.dmp

Download

memory/4256-36-0x0000000004050000-0x0000000004148000-memory.dmp

Download

memory/4256-39-0x0000000004050000-0x0000000004148000-memory.dmp

Download

memory/4256-40-0x0000000000420000-0x0000000000432000-memory.dmp

Download

memory/4256-41-0x0000000029880000-0x00000000298D3000-memory.dmp

Download

memory/4256-29-0x0000000002970000-0x0000000002A74000-memory.dmp

Download

memory/4256-27-0x0000000002830000-0x0000000002951000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads