e10d392fa62ff320de683c3220c9ca0bdd37412ee40479bdbc861a884ea181c5

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a2b2f0f3e7e0dcb7db800f16da87c5a.exe
Size 8KB
Sample231224-3mxkkafdf9
SHA256 e10d392fa62ff320de683c3220c9ca0bdd37412ee40479bdbc861a884ea181c5
MD5 1a2b2f0f3e7e0dcb7db800f16da87c5a
SHA1 c5085a278e705184f725791ab9f40b553f026277
SHA512 d51365c5e940fdca6e53c51d97a78f1b6662f96d429a925711034c9e25687071f903df419b37009a6649cdc519de34e5abf149426361bb4b60180e3c78d25c50
SSDEEP 192:e9+tTSXDZAMc9Xlgz7FaNJhLkwcud2DH9VwGfct1VHO:e9e2Kd9XO1aNJawcudoD7U5u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	1a2b2f0f3e7e0dcb7db800f16da87c5a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2004-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/2004-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
4084	regedit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2168	2004	1a2b2f0f3e7e0dcb7db800f16da87c5a.exe	88
PID 2004 wrote to memory of 2168	2004	1a2b2f0f3e7e0dcb7db800f16da87c5a.exe	88
PID 2004 wrote to memory of 2168	2004	1a2b2f0f3e7e0dcb7db800f16da87c5a.exe	88
PID 2168 wrote to memory of 2640	2168	b2e.exe	90
PID 2168 wrote to memory of 2640	2168	b2e.exe	90
PID 2168 wrote to memory of 2640	2168	b2e.exe	90
PID 2640 wrote to memory of 4084	2640	cmd.exe	93
PID 2640 wrote to memory of 4084	2640	cmd.exe	93
PID 2640 wrote to memory of 4084	2640	cmd.exe	93
PID 2168 wrote to memory of 2216	2168	b2e.exe	94
PID 2168 wrote to memory of 2216	2168	b2e.exe	94
PID 2168 wrote to memory of 2216	2168	b2e.exe	94

C:\Users\Admin\AppData\Local\Temp\1a2b2f0f3e7e0dcb7db800f16da87c5a.exe
"C:\Users\Admin\AppData\Local\Temp\1a2b2f0f3e7e0dcb7db800f16da87c5a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\4343.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\4343.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\4343.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\1a2b2f0f3e7e0dcb7db800f16da87c5a.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\449A.tmp\batfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s "C:\Temp\auth.reg"
      4⤵
      Runs .reg file with regedit
      PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\4343.tmp\b2e.exe
Size 13KB
SHA256 b40120617da73013928cf36a9545bf21034c6fd755e8efcff1baf9cb59f967dc
MD5 63d35c65b9ff36b1a862ce505cba55da
SHA1 b909a24cbd1ae7cd7e2cb3bbb63b5f4fc6dea4da
SHA512 7ce87d2fa433b60dcc960d72ff4e68358600638d591f25722561a0561779802740e7ca533244827712f34f7d476b9a5a0b5c7ba129c87f585ad107e14fcd15bc
SSDEEP 192:3R5Fhp8cdwpHR3AkPLiM79mLU2Pctd+wWkNUPbC:B5FZdgAkTiM79mgLom
MD5 SHA1 SHA512 SSDEEP

Submit Download

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\449A.tmp\batfile.bat
Size 4KB
SHA256 00732042e6dbbc5cf9795d8276bda26b1752fd0604cdf4edd76595220011fb27
MD5 b309a4e828ab0d6a889f23cc4b973eae
SHA1 a3619ffa6cc9ddd21a52a5f9dc42da1c2595a971
SHA512 620a87458e4a5710191271bbc202e631b76f5758bbd3fdea688613a29723a16e50b86036a89300b0175c38806047e39511301a888cd0fce39590f79e84c06ebe
SSDEEP 48:DeSedW7FaWf5bB3zLZHJo45NpR5vRu2UuH/DhR5bB3zLZHJo45NpR5GUPbi7:S5dW7wWUVzJUPb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 a4c0b1ece742846020d9ca5468bae2ab6baed56c71ae6be71fc7f146f621209b
MD5 cf1c01494da6bf3046276d8837775a1a
SHA1 6ee94a709f5b3e6b77293ba755900c4048fb6d7a
SHA512 0d8d325d113cb8f49a45dc7c63805533f43ae875bbbab578290c4c9a24c7ee1ed663c20e7cbb56985b1e9d74663afc19e37f26a0555cf7ca575ddbb2c88a14b3
MD5 SHA1 SHA512

Submit Download

memory/2004-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2004-11-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2168-9-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2168-18-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads