b586cd5cc5bbadea857316df1beef274e754c31be660ea66a411c55510cb17ec

Analysis

max time kernel
123s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2023, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample231210-mhm8bsdaeq
SHA256 b586cd5cc5bbadea857316df1beef274e754c31be660ea66a411c55510cb17ec
MD5 879ffb081a6536b52dd02fc4ea14d96e
SHA1 c1c06f71c08b4075fda2cc91e1f8c4b68aa75398
SHA512 6bbde3b76778f6ab54c7170b20711dbcbeb8b4b2d6f808de2bfb45288c413902b5d710f0916d8e1f60196d8ca6866c50e56b1ca2ad8cf6fd3500c7c8a0fe269e
SSDEEP 49152:B8VlgzBl6xKvh8G3jaR6p6KnfKH7LS0+mRcyY3/+UFgVkIfY2gx/GaYDomMq/7:B8VlgGMh8kuR6p6Ks/S0ZRgNIf/J/M2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
4780	rundll32.exe
3424	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1244	3140	file.exe	91
PID 3140 wrote to memory of 1244	3140	file.exe	91
PID 3140 wrote to memory of 1244	3140	file.exe	91
PID 1244 wrote to memory of 2316	1244	cmd.exe	95
PID 1244 wrote to memory of 2316	1244	cmd.exe	95
PID 1244 wrote to memory of 2316	1244	cmd.exe	95
PID 2316 wrote to memory of 4780	2316	control.exe	97
PID 2316 wrote to memory of 4780	2316	control.exe	97
PID 2316 wrote to memory of 4780	2316	control.exe	97
PID 4780 wrote to memory of 2340	4780	rundll32.exe	101
PID 4780 wrote to memory of 2340	4780	rundll32.exe	101
PID 2340 wrote to memory of 3424	2340	RunDll32.exe	102
PID 2340 wrote to memory of 3424	2340	RunDll32.exe	102
PID 2340 wrote to memory of 3424	2340	RunDll32.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\0TiqG9.bAt
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL",
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4780
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL",
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL",
        6⤵
        Loads dropped DLL
        
        PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0Tiqg9.BaT

Path C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\0Tiqg9.BaT
Size 74B
SHA256 4e6a8e148cdcc7192a07a2a8b8609f8b136b9130bb0cf031699634ec38c6c509
MD5 7be3c7daac085d36ab4b5fedc252698b
SHA1 94a158c6ac5e0a6b9bd5be641d1a119cde337a53
SHA512 d051c24766ddc5f4633b1e9b7fe75166953f95cdf734947dffe5cf22bc2dfaff1896b5de46ee4a7725a0eb648049530923affc721e593d11c40a53e70f493d28
MD5 SHA1 SHA512

Submit Download

DTrSV.CpL

Path C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL
Size 3.0MB
SHA256 9cabdbb405ea24809157b4ef60d2607d602c859e9449b05a6590248615e6f1a0
MD5 fb36c3c071a50ad6826b74b5d490a786
SHA1 069d01e7bfbde71f35bec1e6849477b8a17652a6
SHA512 ed4eb9639ddbaecd1a1138841fafb29d3c65c9a2fbf3d9f1746731b6d4aee4329f848819631778f69c5ab1d9a0e33e68eaa3ad2e4a529227e70c78bfce3fd300
SSDEEP 49152:Xwt/hO5Kvo4B7jaRBp3sn7K87LS+7kRc+X3v+kOg3S0fYOKx8wFxDjNfaSH75:XwK0o49uRBp3sx/S+gRF60fDEdfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DTrSV.CpL

Path C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL
Size 3.0MB
SHA256 9cabdbb405ea24809157b4ef60d2607d602c859e9449b05a6590248615e6f1a0
MD5 fb36c3c071a50ad6826b74b5d490a786
SHA1 069d01e7bfbde71f35bec1e6849477b8a17652a6
SHA512 ed4eb9639ddbaecd1a1138841fafb29d3c65c9a2fbf3d9f1746731b6d4aee4329f848819631778f69c5ab1d9a0e33e68eaa3ad2e4a529227e70c78bfce3fd300
SSDEEP 49152:Xwt/hO5Kvo4B7jaRBp3sn7K87LS+7kRc+X3v+kOg3S0fYOKx8wFxDjNfaSH75:XwK0o49uRBp3sx/S+gRF60fDEdfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DTrSV.CpL

Path C:\Users\Admin\AppData\Local\Temp\7zS44C4D808\DTrSV.CpL
Size 3.0MB
SHA256 9cabdbb405ea24809157b4ef60d2607d602c859e9449b05a6590248615e6f1a0
MD5 fb36c3c071a50ad6826b74b5d490a786
SHA1 069d01e7bfbde71f35bec1e6849477b8a17652a6
SHA512 ed4eb9639ddbaecd1a1138841fafb29d3c65c9a2fbf3d9f1746731b6d4aee4329f848819631778f69c5ab1d9a0e33e68eaa3ad2e4a529227e70c78bfce3fd300
SSDEEP 49152:Xwt/hO5Kvo4B7jaRBp3sn7K87LS+7kRc+X3v+kOg3S0fYOKx8wFxDjNfaSH75:XwK0o49uRBp3sx/S+gRF60fDEdfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3424-26-0x0000000002970000-0x0000000002A75000-memory.dmp

Download

memory/3424-25-0x0000000002970000-0x0000000002A75000-memory.dmp

Download

memory/3424-22-0x0000000002970000-0x0000000002A75000-memory.dmp

Download

memory/3424-21-0x0000000002840000-0x0000000002961000-memory.dmp

Download

memory/3424-18-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/4780-8-0x0000000001110000-0x0000000001116000-memory.dmp

Download

memory/4780-16-0x00000000033A0000-0x00000000034A5000-memory.dmp

Download

memory/4780-15-0x00000000033A0000-0x00000000034A5000-memory.dmp

Download

memory/4780-12-0x00000000033A0000-0x00000000034A5000-memory.dmp

Download

memory/4780-11-0x0000000003270000-0x0000000003391000-memory.dmp

Download

memory/4780-9-0x0000000010000000-0x00000000102FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads