244eb0ad0241941cbad1aaccbb8668977a278f4dec265f08538755364d82c02e

General

Target

1415048428e606397ca295a7681acf02.exe
Size

1.1MB
MD5

1415048428e606397ca295a7681acf02
SHA1

c93061e132c429afaf6fe8084fe51c672d04f528
SHA256

244eb0ad0241941cbad1aaccbb8668977a278f4dec265f08538755364d82c02e
SHA512

294a5317a72dffd51155d56c57f1c74be2c808d220c4ff3e6543384df74174f0d5f705ba0d1a29f6c2f81a86a74a1f0de601f73c954a6a2b3a661aa8005daaee
SSDEEP

24576:DgCfMLQ6gSy8Q7BiNL+VElHA1dHdQ0aKMrzws1Ztf3vH:MCEUOQdiNiElHAbdoKUwsVf3vH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	1415048428e606397ca295a7681acf02.exe

Executes dropped EXE 2 IoCs

pid	Process
4584	starter.exe
2656	ArcadeYum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ArcadeYum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ArcadeYum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ArcadeYum.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	ArcadeYum.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ArcadeYum.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5104	1415048428e606397ca295a7681acf02.exe
5104	1415048428e606397ca295a7681acf02.exe
2656	ArcadeYum.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	ArcadeYum.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2656	ArcadeYum.exe
2656	ArcadeYum.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4584	5104	1415048428e606397ca295a7681acf02.exe	22
PID 5104 wrote to memory of 4584	5104	1415048428e606397ca295a7681acf02.exe	22
PID 5104 wrote to memory of 4584	5104	1415048428e606397ca295a7681acf02.exe	22
PID 5104 wrote to memory of 2656	5104	1415048428e606397ca295a7681acf02.exe	29
PID 5104 wrote to memory of 2656	5104	1415048428e606397ca295a7681acf02.exe	29
PID 5104 wrote to memory of 2656	5104	1415048428e606397ca295a7681acf02.exe	29

C:\Users\Admin\AppData\Local\Temp\1415048428e606397ca295a7681acf02.exe
"C:\Users\Admin\AppData\Local\Temp\1415048428e606397ca295a7681acf02.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe
  "C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe" bUAPg0EWVhrdYi85ExBO 942
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe
  "C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe" IC9UaWNrZXQ9YlVBUGcwRVdWaHJkWWk4NUV4Qk8gL0J1bmRsZXM9MTYzfDE0NXwxMzR8MTYyIC9PYmVyb249MSAvQnJvd3Nlcj0zIC9BZExvYz05NDIgL3RwZD1odHRwOi8vZDEuYXJjYWRleXVtLmNvbS9hai9idW5kbGUvOTQyLz9wPVlUUXlOamt5T0RVeU1UQjQzSGM4MXB0aHVTQnpUaFljJTJCVElNTFVnUUdmdWdicXJhJTJCZHVqY0ZOYjBEcGZ0U3VNYWRmSTNQMVUlMkI0UldIZTVXejJsdDhCSGQwRWJxRjIwaERETVcgL29wdGltaXplR0M9MCAvdXNlck5hbWU9QWRtaW4gL3VzZXJTSUQ9Uy0xLTUtMjEtMzgwMzUxMTkyOS0xMzM5MzU5Njk1LTIxOTExOTU0NzYtMTAwMAo=
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe

Filesize
9KB

MD5
1f973739baf3e0b0c74164a91a415bf9

SHA1
baa1b165d326be85ff577a8969f4669931d11b7c

SHA256
c3acdfc7f606b4c4112315033ec873421ca982cd8a9be59c42e942be7ed4679b

SHA512
cee3a3509169f50d11ddfcc0dd855adc87e3d7447c17de673e94c4a89f9d6b861fdb62fbfeb246e80b8c6b12484a102d33ead659841b60161e96a1c680a621c7

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe

Filesize
14KB

MD5
6e090ebb7b3d8e11c579ec4bcea51056

SHA1
65fdfe698c9244d7f24e034144a0fa485232ed35

SHA256
de3f6afd1f0dd531db24b9269828a0e704aa9c3f2197ef69881d112aa3e427a2

SHA512
14e7f6b6b9ec33889a21d5d7a2fd30b9f1b400981d61dbdb085d8ba1e74f20d883fa6f0ebaea9c0cc0912cba3864a9fcd7a9fba7ae328979546418e8a84e8782

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe.config

Filesize
231B

MD5
ae437dea18c61477cc2f17f46fb11d01

SHA1
94afba8148c6072ad60c6899ed717005681e9da5

SHA256
d8966d4c96ba3c910f86c44d6d7b6c298cc70cc3c5c61bb975861eed846b0754

SHA512
61ad33f07fbb65863f1eb02a14230c38766fbb5e1fe4263433ecd32375249e7af71e49f054e5f919884f5250dccf95fb6791ceeadf3c2d4cb468ba5af3e8902b

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe

Filesize
4KB

MD5
e4e7f89913efd57f38f0325f050f6d17

SHA1
34bb9e823c6f6c866620590b2796476bc7e921af

SHA256
5aa0e9e4ba8d2f394682a489608d4772d6300223e09d97241ca47cb6b3be8050

SHA512
5ffbd7eb8282e7e9fc5dd3edc7bfebb00c643584b112d331e508fd13041a99a81697aadc7f3f65df1ab1a9d4c3da8510503e3443ba5a76cc01bfc80c46480a19

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe

Filesize
5KB

MD5
b5907afebb5b11447b4416f3081dc6bc

SHA1
efa06be85f1c4dc126daf681df3c95d765be625b

SHA256
1d0ea9e5f5607f3822a59e480b1e931173511b0e92cb4d207a54194412e4b540

SHA512
bbab30bdb4d2fd7a6597538d29b3ac4f7bbfd1cfda123f90c7b21a11edc7504ec94fd4826353380bf0e2d0a5eaf2d347ec648e99cf606a005669c316a9f7b3b7

Download Submit
memory/2656-20-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/2656-18-0x0000000000B20000-0x0000000000C02000-memory.dmp

Filesize
904KB

Download
memory/2656-19-0x0000000073FB0000-0x0000000074760000-memory.dmp

Filesize
7.7MB

Download
memory/2656-21-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download
memory/2656-23-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download
memory/2656-22-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/2656-24-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/2656-25-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/2656-28-0x0000000073FB0000-0x0000000074760000-memory.dmp

Filesize
7.7MB

Download
memory/2656-29-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/2656-30-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download
memory/2656-31-0x0000000005910000-0x0000000005920000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads