6ec22a92db8df3f4fa62743561222daffe600e03b81b6a73acc2ac9f95fd25cd

General

Target
5612f6b2a58e2789f369918b313beda8.exe
Size 15KB
Sample231219-td5edacca9
SHA256 6ec22a92db8df3f4fa62743561222daffe600e03b81b6a73acc2ac9f95fd25cd
MD5 5612f6b2a58e2789f369918b313beda8
SHA1 89b504297b9ad7472ee3f6941395281d4ffd466d
SHA512 8ffebc914b5d4f1108855042114738879b4c8e30e0e1481cb87466ec6a8af3bf53a2453bd09c55e3529ebdfce08223656adc297727a6d701d09d578d02184295
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJHM:hDXWipuE+K3/SSHgxmlOJHM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	DEM42D5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	DEM9923.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	DEMEF32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	DEM4580.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	DEM9B70.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	5612f6b2a58e2789f369918b313beda8.exe

Executes dropped EXE 6 IoCs

pid	Process
4680	DEM42D5.exe
1204	DEM9923.exe
4464	DEMEF32.exe
2444	DEM4580.exe
4036	DEM9B70.exe
4048	DEMF0C4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4680	820	5612f6b2a58e2789f369918b313beda8.exe	95
PID 820 wrote to memory of 4680	820	5612f6b2a58e2789f369918b313beda8.exe	95
PID 820 wrote to memory of 4680	820	5612f6b2a58e2789f369918b313beda8.exe	95
PID 4680 wrote to memory of 1204	4680	DEM42D5.exe	101
PID 4680 wrote to memory of 1204	4680	DEM42D5.exe	101
PID 4680 wrote to memory of 1204	4680	DEM42D5.exe	101
PID 1204 wrote to memory of 4464	1204	DEM9923.exe	103
PID 1204 wrote to memory of 4464	1204	DEM9923.exe	103
PID 1204 wrote to memory of 4464	1204	DEM9923.exe	103
PID 4464 wrote to memory of 2444	4464	DEMEF32.exe	105
PID 4464 wrote to memory of 2444	4464	DEMEF32.exe	105
PID 4464 wrote to memory of 2444	4464	DEMEF32.exe	105
PID 2444 wrote to memory of 4036	2444	DEM4580.exe	108
PID 2444 wrote to memory of 4036	2444	DEM4580.exe	108
PID 2444 wrote to memory of 4036	2444	DEM4580.exe	108
PID 4036 wrote to memory of 4048	4036	DEM9B70.exe	110
PID 4036 wrote to memory of 4048	4036	DEM9B70.exe	110
PID 4036 wrote to memory of 4048	4036	DEM9B70.exe	110

C:\Users\Admin\AppData\Local\Temp\5612f6b2a58e2789f369918b313beda8.exe
"C:\Users\Admin\AppData\Local\Temp\5612f6b2a58e2789f369918b313beda8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\DEM42D5.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM42D5.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Users\Admin\AppData\Local\Temp\DEM9923.exe
    "C:\Users\Admin\AppData\Local\Temp\DEM9923.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\DEMEF32.exe
      "C:\Users\Admin\AppData\Local\Temp\DEMEF32.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\DEM4580.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM4580.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\DEM9B70.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM9B70.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\DEMF0C4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMF0C4.exe"
        7⤵
        Executes dropped EXE
        
        PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM42D5.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM42D5.exe
Size 15KB
SHA256 8c0cb278c22dd4c5ddabba12ed97a572380bd545cc9c8792c570ed9ca5561326
MD5 77a51e4c47b12f2bc8a01a5d5c13eadd
SHA1 41a3858638f25572b1bb574e53fdfe43242faf72
SHA512 c6997baa4d6de050a10d28b477e0dbb2bd58197865d7203ccd7ae31ee851eebcd224e84569252b1a8c6c1fdcd08cc6b06061e40b16807d3e2d7a7da06f6169a1
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJHG:hDXWipuE+K3/SSHgxmlOJHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM4580.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM4580.exe
Size 15KB
SHA256 6feb9c2b57937f30f893f5037b2fa4a9bca7484527f05d31fd8df97820b86bd6
MD5 1542718fcd0b2617601092d9ce302fbe
SHA1 f5d9c790adec0bbe3f1eff8844427c808f6e1329
SHA512 98a60694c61f67535d7ea7d5b7ebc40a23bf346d492dfa1e6a971a767754b146111d8fb570b045a41880e5718cfbd00d1f7f98e04bac0c3c7a567c10a7f1b8f8
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJHr:hDXWipuE+K3/SSHgxmlOJHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM9923.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM9923.exe
Size 15KB
SHA256 63eba74691d8178154ed1204f10d2188a0963b6889c7511f44e7a6cd17298c10
MD5 0026dc650b85c9c142c3cb6d263ec57e
SHA1 fd2a1f238e27d91f311439d5101066be9238a802
SHA512 8e2a9ed96dae034e766f6e75d4528711668e570b7e99abdf3c2a0b5ad81460d080aab2e8a72486ae02c88357a10d560dca5f9aceaef5c9a76cce4a932eac8182
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJH/:hDXWipuE+K3/SSHgxmlOJH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM9B70.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM9B70.exe
Size 15KB
SHA256 9b34a140265f32450ac6a026346e010e8a203b4b60ce8b93371dfa48d0953f07
MD5 6c15da562d12ace00540ca738e7f123f
SHA1 303144f5ba85c3ef3018b0ca1700cd0b0786950b
SHA512 d0b7827c3b5170fa234806a991d6acd6e79f920a59e94e7a8119120843086df18a08196fdbbbf1d1380a3fa69b1c853f03590f0aaf62cb7aedb896114913888b
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJHe:hDXWipuE+K3/SSHgxmlOJHe
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMEF32.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMEF32.exe
Size 15KB
SHA256 e6bd4ec26febdffa1ddf6b07e0720d7f8ad98bae4b917809f6e96ff4af458929
MD5 854b5aa313109d615a80facefd7ed260
SHA1 ccbf3629626d40c0a2cded2e753930347e633f32
SHA512 bbdd30ec14457c2dd9be8f915e22eef4ae4c3d978d0d96c92092aded8e908961415cb196b9813d5e3b7690f53e2a0e6efa9c19795224ba8e66ef24ddbb0396c4
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJHj:hDXWipuE+K3/SSHgxmlOJHj
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMF0C4.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMF0C4.exe
Size 15KB
SHA256 45bc38cb562ce8f6055bdd0c2c05b612cffd392894ec0fe4217915d57b5dd9cf
MD5 853a882ba9f68f73e939ae9e2da5617e
SHA1 a14318009c3a74796cfcb00d8aac2401b7730370
SHA512 29164869bf167ead90af2b9b7d55418d7a29d658884880509213b99414c51ff429125f9ece99920f12f93945c6f106053db42abca212d199104be8e694ca2d34
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYl0rJH4:hDXWipuE+K3/SSHgxmlOJH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads