d82675bace2a9b0202d872f9f06c1c4dd7fb4d21c1a058602b937389140c33b8

General

Target

0cac075f245ad2047532c39acfbe3cf1.exe
Size

4.2MB
MD5

0cac075f245ad2047532c39acfbe3cf1
SHA1

db8fb6a038ab78064fc4513076eadebf24e185f2
SHA256

d82675bace2a9b0202d872f9f06c1c4dd7fb4d21c1a058602b937389140c33b8
SHA512

a483cba950174536ff4ab23fe77d7120b8093939276727c45f3596c74fd46e3c672eed10a90647b3e959aa0d7d6e38a4b1de779b74a70d86d6bd5444c44ea987
SSDEEP

98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluU:ovsJR0TW6yiIKRhzqOsU

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	0cac075f245ad2047532c39acfbe3cf1.exe

Deletes itself 1 IoCs

pid	Process
1916	3S93T.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	3S93T.exe

Loads dropped DLL 2 IoCs

pid	Process
688	0cac075f245ad2047532c39acfbe3cf1.exe
1916	3S93T.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1916	3S93T.exe
1916	3S93T.exe
1916	3S93T.exe
1916	3S93T.exe
1916	3S93T.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	0cac075f245ad2047532c39acfbe3cf1.exe
Token: 0	688	0cac075f245ad2047532c39acfbe3cf1.exe
Token: SeDebugPrivilege	1916	3S93T.exe
Token: 0	1916	3S93T.exe
Token: SeShutdownPrivilege	1916	3S93T.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 1916	688	0cac075f245ad2047532c39acfbe3cf1.exe	91
PID 688 wrote to memory of 1916	688	0cac075f245ad2047532c39acfbe3cf1.exe	91

C:\Users\Admin\AppData\Local\Temp\0cac075f245ad2047532c39acfbe3cf1.exe
"C:\Users\Admin\AppData\Local\Temp\0cac075f245ad2047532c39acfbe3cf1.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688
- C:\Users\Admin\AppData\Local\Temp\3S93T.exe
  "C:\Users\Admin\AppData\Local\Temp\3S93T.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\0cac075f245ad2047532c39acfbe3cf1.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3S93T.exe

Filesize
199KB

MD5
149ceb221af92bb7f6cb8e57cd0ed8e6

SHA1
a80f5dca9e278eaddfe32f5da11a1a29bf0218b1

SHA256
f0d6463255b744052b39598cd35b1cffa131cfbe67ba04d84aacc2b69ac0b192

SHA512
0a852aa7c469091b1ed8fef1c68251a490b89448317a794c0da8b40ddbdcafd0aaa772c8e2655910db67a433d2e5d0f1a66359a8228ed0beb13fce2fd6407cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3S93T.exe

Filesize
269KB

MD5
c5ab2cb0a211f96b9213b2f96a727b5f

SHA1
e61be8e00702b613f2d3007b56521721d8e6ef21

SHA256
39ad5c999fc56d79a8e3ae455cce439246eb8800a264995cc19ded73b4b1b626

SHA512
767792d3ff4732ff8a60c3d89eda3867132a4759c3ad34b0b1e1dc137a809ee6d215b4caae9a261ac6774f148a24bf4607c8282653e9594cae275014d3b1f1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\3S93T.exe

Filesize
197KB

MD5
227f5a8b994e0f561b6344337f763b59

SHA1
a47842e8a279201d1a3d2dc052f9f06969fc23ce

SHA256
f3afbd9f4da4e5576ca307a507d69b2f68f85a91afee6cbee33fd237f0b695ee

SHA512
07ddd29e77f97180cca009e05b2a670fb3a13be9c95d473a3b4f718aeeefadfedc57108f125a48e913bd5096424f65f0dadb896b0747bad6762d249e638e0966

Download Submit
C:\Users\Admin\AppData\Local\Temp\DIH\VAC.zip

Filesize
13KB

MD5
5a8e8dedf1d910c79defff5638978d07

SHA1
bfab518af8a53f02c4f98fc321aa0984a208686c

SHA256
d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893

SHA512
7acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll

Filesize
454KB

MD5
b8523a54c782108206827454b6700ee0

SHA1
f723b33a02a1d6c393e0e1492f46ff14335b204b

SHA256
f4b3040e4bfae9208ffbc4a1ae28621942f8a56c0d916a94aa8cd00cbc483d6f

SHA512
b80fef68142fcce7634813770e530ce322cdf9fafe1886ccc7f18478a5d6999dc73248008875c4eb39c44b4cd9ee9d27a2cf3d99bc944c458a88df4b36d27245

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll

Filesize
410KB

MD5
d0878b5ffb6501df4ddbc11b27d533ee

SHA1
f61d1190e1eb1fefe012597ef6ce0b755f5bcd73

SHA256
2b014901317a83b8038d6f662d2b8d69ee89e8cd2c5c3541893dcb1ba36fadf3

SHA512
1a04ad141ba7bd48bd78de86514c7615fb671d5bd0544e45d5816a0a13f43c28e4db45fce927ed56fc6de3445f327692074bd5192045fffbc22de12f17b0b289

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll

Filesize
708KB

MD5
5983c0afb0d6e0ebccf5650bffa19a3c

SHA1
bcee10cb0795d8aa406953f9158384b65281cd51

SHA256
d5c84d765d2c40c1def2e98e972b2648249c1eb422b165d67a636152fd163a47

SHA512
b22927e4010b8ef17d2a9475301f44da04c861cfda7c5e08343b3669e59dd1c204c81f97addb8bc8d91d4a21e04dc8caa51642f3adb21d83ae5faa4ca67173dc

Download Submit
memory/688-7-0x000001F29AFB0000-0x000001F29AFC0000-memory.dmp

Filesize
64KB

Download
memory/688-6-0x000001F29AFB0000-0x000001F29AFC0000-memory.dmp

Filesize
64KB

Download
memory/688-14-0x000001F29C030000-0x000001F29C03A000-memory.dmp

Filesize
40KB

Download
memory/688-13-0x000001F29C050000-0x000001F29C062000-memory.dmp

Filesize
72KB

Download
memory/688-5-0x000001F29B0A0000-0x000001F29B1F4000-memory.dmp

Filesize
1.3MB

Download
memory/688-4-0x000001F2826D0000-0x000001F282712000-memory.dmp

Filesize
264KB

Download
memory/688-3-0x000001F29AFC0000-0x000001F29B0A0000-memory.dmp

Filesize
896KB

Download
memory/688-33-0x00007FFDE0320000-0x00007FFDE0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/688-2-0x000001F29AFB0000-0x000001F29AFC0000-memory.dmp

Filesize
64KB

Download
memory/688-0-0x000001F2803A0000-0x000001F2807D6000-memory.dmp

Filesize
4.2MB

Download
memory/688-1-0x00007FFDE0320000-0x00007FFDE0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-34-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-35-0x0000018C41A70000-0x0000018C41AB2000-memory.dmp

Filesize
264KB

Download
memory/1916-37-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-36-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-40-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-32-0x00007FFDE0320000-0x00007FFDE0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-42-0x0000018C449B0000-0x0000018C44B36000-memory.dmp

Filesize
1.5MB

Download
memory/1916-43-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-44-0x0000018C42E80000-0x0000018C42E98000-memory.dmp

Filesize
96KB

Download
memory/1916-47-0x00007FFDE0320000-0x00007FFDE0DE1000-memory.dmp

Filesize
10.8MB

Download
memory/1916-48-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-49-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-50-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-53-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-54-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-55-0x0000018C41AB0000-0x0000018C41AC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing