e1a433bda3d720805083fa08ab90cdc160096ce1b2c0e577a6ba2c6a75c6faa7

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2023, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample231210-hlb71sead4
SHA256 e1a433bda3d720805083fa08ab90cdc160096ce1b2c0e577a6ba2c6a75c6faa7
MD5 793570e1f1bd094c1b651de8211c3754
SHA1 7926bfcba0f352245cf42f2eba256493cb367415
SHA512 1023036946e767aaa97cab42b7f4282c60bdc7d1a7eb3bf9874f506a3c3999627860803818201b3ebdd49900ce54a82065f96248f91c9ad5d057f56fdd052492
SSDEEP 49152:ISjm4GHeGugQ5RCA+j7pcJW39XrGnTIfqO6ZlfpmQkKBdpDF+JbHmmtmS0xEQR+z:ISjazXQOAM7pZtXxqLlfpmQkKpiHpWEN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
116	rundll32.exe
1452	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4944	2788	file.exe	91
PID 2788 wrote to memory of 4944	2788	file.exe	91
PID 2788 wrote to memory of 4944	2788	file.exe	91
PID 4944 wrote to memory of 4696	4944	cmd.exe	94
PID 4944 wrote to memory of 4696	4944	cmd.exe	94
PID 4944 wrote to memory of 4696	4944	cmd.exe	94
PID 4696 wrote to memory of 116	4696	control.exe	95
PID 4696 wrote to memory of 116	4696	control.exe	95
PID 4696 wrote to memory of 116	4696	control.exe	95
PID 116 wrote to memory of 4028	116	rundll32.exe	101
PID 116 wrote to memory of 4028	116	rundll32.exe	101
PID 4028 wrote to memory of 1452	4028	RunDll32.exe	102
PID 4028 wrote to memory of 1452	4028	RunDll32.exe	102
PID 4028 wrote to memory of 1452	4028	RunDll32.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\lbTj.BAT" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL",
        6⤵
        Loads dropped DLL
        
        PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B_.CPL

Path C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL
Size 3.0MB
SHA256 91049ba9ae392cbbd34ddfc845ffe52d329a2a219119f84e19e88e8e4959fbdc
MD5 642c743cad309cc5cc060d041e9a86fd
SHA1 f1a6f8794b47cd1a9179b04d0ebbfd8ab2ef4848
SHA512 409ab0cdd318d8d1743c4446d4c7b2fb97d3ce9da971a9e5f6e410d991450a8b5484db063c2ec3d4e5d21f5d2b79476a6ed947cb1b825ad96907929769cee26b
SSDEEP 49152:UT1EQ53rNXKczXSQR8HWlnJZqP69yiFJfy1p2ZhwQP/BRkVxMmsf:U553r5KczXSq82lnf9yiFucPZR2Of
MD5 SHA1 SHA512 SSDEEP

Submit Download

B_.CPL

Path C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL
Size 3.0MB
SHA256 91049ba9ae392cbbd34ddfc845ffe52d329a2a219119f84e19e88e8e4959fbdc
MD5 642c743cad309cc5cc060d041e9a86fd
SHA1 f1a6f8794b47cd1a9179b04d0ebbfd8ab2ef4848
SHA512 409ab0cdd318d8d1743c4446d4c7b2fb97d3ce9da971a9e5f6e410d991450a8b5484db063c2ec3d4e5d21f5d2b79476a6ed947cb1b825ad96907929769cee26b
SSDEEP 49152:UT1EQ53rNXKczXSQR8HWlnJZqP69yiFJfy1p2ZhwQP/BRkVxMmsf:U553r5KczXSq82lnf9yiFucPZR2Of
MD5 SHA1 SHA512 SSDEEP

Submit Download

B_.CPL

Path C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\B_.CPL
Size 3.0MB
SHA256 91049ba9ae392cbbd34ddfc845ffe52d329a2a219119f84e19e88e8e4959fbdc
MD5 642c743cad309cc5cc060d041e9a86fd
SHA1 f1a6f8794b47cd1a9179b04d0ebbfd8ab2ef4848
SHA512 409ab0cdd318d8d1743c4446d4c7b2fb97d3ce9da971a9e5f6e410d991450a8b5484db063c2ec3d4e5d21f5d2b79476a6ed947cb1b825ad96907929769cee26b
SSDEEP 49152:UT1EQ53rNXKczXSQR8HWlnJZqP69yiFJfy1p2ZhwQP/BRkVxMmsf:U553r5KczXSq82lnf9yiFucPZR2Of
MD5 SHA1 SHA512 SSDEEP

Submit Download

lbTj.BAT

Path C:\Users\Admin\AppData\Local\Temp\7z82A23AE4\lbTj.BAT
Size 73B
SHA256 b59fb13228650a6e3900891c3c0d8d432b0631fbca378a9ee58392ad20d7735d
MD5 a6e95255b983da51abf048ace8e1f252
SHA1 8f0189f7ee088df6c96268e3efef78881f532abb
SHA512 fb0a236566f86a70e31727a6cf28f8f40db2e3026e4e0fa8660c3dc2671808f2e7d1934689de82d1194f1f78cd9d8cb94ed146ce1236f310594d223cbd613557
MD5 SHA1 SHA512

Submit Download

memory/116-16-0x00000000034B0000-0x00000000035D0000-memory.dmp

Download

memory/116-12-0x0000000003370000-0x00000000034AE000-memory.dmp

Download

memory/116-13-0x00000000034B0000-0x00000000035D0000-memory.dmp

Download

memory/116-14-0x00000000034B0000-0x00000000035D0000-memory.dmp

Download

memory/116-9-0x0000000002A40000-0x0000000002A46000-memory.dmp

Download

memory/116-17-0x00000000034B0000-0x00000000035D0000-memory.dmp

Download

memory/116-10-0x0000000010000000-0x0000000010300000-memory.dmp

Download

memory/1452-19-0x00000000012D0000-0x00000000012D6000-memory.dmp

Download

memory/1452-22-0x0000000003530000-0x000000000366E000-memory.dmp

Download

memory/1452-24-0x0000000003670000-0x0000000003790000-memory.dmp

Download

memory/1452-26-0x0000000003670000-0x0000000003790000-memory.dmp

Download

memory/1452-27-0x0000000003670000-0x0000000003790000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads