1d5fca467febc247c2a12cc769d9d2de763eb64e1bc70a554683360fbbfd7ac4

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2023, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample231210-d2gp8addd8
SHA256 1d5fca467febc247c2a12cc769d9d2de763eb64e1bc70a554683360fbbfd7ac4
MD5 7bae2de2b2ffab2b91bf16a5bf308389
SHA1 04642aa8a83f4ddd6e5edeb41efdffbdf81725a6
SHA512 c9e95d3b56327eab9bb5597142f3e9198de6a994565761a6b1cdd9cb1b82f0eec4d7d4b9b3eb9fb18e00f3ec7998b1bed83bbcd05d5710cdb46035604df2d224
SSDEEP 49152:yenIbgDAH5HOlNO3qJYTWNnbnfeew0gSvmcCjOVxk5NidhdL5fMh97a1Tl/kXBoV:yenSfH5HO//eEnTme95vTrhVEwtIBolH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1512	rundll32.exe
3820	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 2024	3472	file.exe	93
PID 3472 wrote to memory of 2024	3472	file.exe	93
PID 3472 wrote to memory of 2024	3472	file.exe	93
PID 2024 wrote to memory of 1452	2024	cmd.exe	96
PID 2024 wrote to memory of 1452	2024	cmd.exe	96
PID 2024 wrote to memory of 1452	2024	cmd.exe	96
PID 1452 wrote to memory of 1512	1452	control.exe	97
PID 1452 wrote to memory of 1512	1452	control.exe	97
PID 1452 wrote to memory of 1512	1452	control.exe	97
PID 1512 wrote to memory of 3460	1512	rundll32.exe	102
PID 1512 wrote to memory of 3460	1512	rundll32.exe	102
PID 3460 wrote to memory of 3820	3460	RunDll32.exe	103
PID 3460 wrote to memory of 3820	3460	RunDll32.exe	103
PID 3460 wrote to memory of 3820	3460	RunDll32.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z81F16D90\2REVWCo.BaT" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl",
        6⤵
        Loads dropped DLL
        
        PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2REVWCo.BaT

Path C:\Users\Admin\AppData\Local\Temp\7z81F16D90\2REVWCo.BaT
Size 80B
SHA256 e8358bbc168a09c6bbdd7a51ba1cd57d5071842b3b5283aef2ebca2a2557bdfa
MD5 d26c747b3bbddb8566124922d26382c9
SHA1 b7d8d452edfb311ec6d7a46e2e419adeedd64cf2
SHA512 62e6033a45d677907d3d44ad5f7585b119c7c27ba46ab44e7672b633dc91a0b74e937c5931eebdcab7b184746ec71b8eb4305d18ea808bb5cc756ea136b933c6
MD5 SHA1 SHA512

Submit Download

62xNjA.Cpl

Path C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl
Size 3.0MB
SHA256 3f772b28f1008498b7021e470be7c0e4cf12d1821abab30324752b30b9a3f3c0
MD5 37a29b27abed42839ced8ef0c63c60df
SHA1 2660023d96254c57bd56dcbd6794111519592842
SHA512 338c7a516f5575915d0654a8ab1ee609991a062fc8db91514d2ddf9e978c0107faa5283a02642203328916590348e6de2d4637d5d27b91c03b32c3f6a30b38da
SSDEEP 49152:sRECQI5GLTpJ2eCJykIWGkJZQkQCXNg1lSlswxLaWhknLGCQ0er8+Z0:sRtELTpDCJ5Iw3xQYNg1lSlkWGnLGR0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

62xNjA.Cpl

Path C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl
Size 3.0MB
SHA256 3f772b28f1008498b7021e470be7c0e4cf12d1821abab30324752b30b9a3f3c0
MD5 37a29b27abed42839ced8ef0c63c60df
SHA1 2660023d96254c57bd56dcbd6794111519592842
SHA512 338c7a516f5575915d0654a8ab1ee609991a062fc8db91514d2ddf9e978c0107faa5283a02642203328916590348e6de2d4637d5d27b91c03b32c3f6a30b38da
SSDEEP 49152:sRECQI5GLTpJ2eCJykIWGkJZQkQCXNg1lSlswxLaWhknLGCQ0er8+Z0:sRtELTpDCJ5Iw3xQYNg1lSlkWGnLGR0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

62xNjA.Cpl

Path C:\Users\Admin\AppData\Local\Temp\7z81F16D90\62xNjA.Cpl
Size 3.0MB
SHA256 3f772b28f1008498b7021e470be7c0e4cf12d1821abab30324752b30b9a3f3c0
MD5 37a29b27abed42839ced8ef0c63c60df
SHA1 2660023d96254c57bd56dcbd6794111519592842
SHA512 338c7a516f5575915d0654a8ab1ee609991a062fc8db91514d2ddf9e978c0107faa5283a02642203328916590348e6de2d4637d5d27b91c03b32c3f6a30b38da
SSDEEP 49152:sRECQI5GLTpJ2eCJykIWGkJZQkQCXNg1lSlswxLaWhknLGCQ0er8+Z0:sRtELTpDCJ5Iw3xQYNg1lSlkWGnLGR0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-16-0x0000000003480000-0x0000000003586000-memory.dmp

Download

memory/1512-12-0x0000000003350000-0x0000000003471000-memory.dmp

Download

memory/1512-13-0x0000000003480000-0x0000000003586000-memory.dmp

Download

memory/1512-14-0x0000000003480000-0x0000000003586000-memory.dmp

Download

memory/1512-9-0x00000000011E0000-0x00000000011E6000-memory.dmp

Download

memory/1512-17-0x0000000003480000-0x0000000003586000-memory.dmp

Download

memory/1512-10-0x0000000010000000-0x00000000102FF000-memory.dmp

Download

memory/3820-19-0x00000000007A0000-0x00000000007A6000-memory.dmp

Download

memory/3820-22-0x0000000002A10000-0x0000000002B31000-memory.dmp

Download

memory/3820-24-0x0000000002B40000-0x0000000002C46000-memory.dmp

Download

memory/3820-26-0x0000000002B40000-0x0000000002C46000-memory.dmp

Download

memory/3820-27-0x0000000002B40000-0x0000000002C46000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads