2299ee6984c3aeec483a4be48e427e3dec27fee52137d8b2e0cca4eca8c4e121

General

Target

437d30ded20280ec346c43e7959980f9.exe
Size

471KB
MD5

437d30ded20280ec346c43e7959980f9
SHA1

2c2af78fe1cb982e2adbc6208f94fcfe4bf33974
SHA256

2299ee6984c3aeec483a4be48e427e3dec27fee52137d8b2e0cca4eca8c4e121
SHA512

e3af3f795e6bf4a832d49dce8f13734eb20431f58a87a69821712530e53b7496066d3f841fc01a31df4db8a6703fbe116c943b390aba73af1df2e1188af935c2
SSDEEP

6144:amsyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XYYY:mpO3StxwGc2c3tfmfsCRA22+m+8s

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	437d30ded20280ec346c43e7959980f9.exe

Executes dropped EXE 1 IoCs

pid	Process
3872	worker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	worker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3872	worker.exe
3872	worker.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3872	2888	437d30ded20280ec346c43e7959980f9.exe	93
PID 2888 wrote to memory of 3872	2888	437d30ded20280ec346c43e7959980f9.exe	93

C:\Users\Admin\AppData\Local\Temp\437d30ded20280ec346c43e7959980f9.exe
"C:\Users\Admin\AppData\Local\Temp\437d30ded20280ec346c43e7959980f9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\DM\worker.exe
  "C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\parent.txt

Filesize
471KB

MD5
437d30ded20280ec346c43e7959980f9

SHA1
2c2af78fe1cb982e2adbc6208f94fcfe4bf33974

SHA256
2299ee6984c3aeec483a4be48e427e3dec27fee52137d8b2e0cca4eca8c4e121

SHA512
e3af3f795e6bf4a832d49dce8f13734eb20431f58a87a69821712530e53b7496066d3f841fc01a31df4db8a6703fbe116c943b390aba73af1df2e1188af935c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe

Filesize
19KB

MD5
2b23c69b68708c14fc214c3454e6b1bd

SHA1
5c923d25c14ad13dab4f05bb1423026f873e7dc4

SHA256
b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd

SHA512
00135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5

Download Submit
memory/3872-36-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-52-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-12-0x00007FFAD81F0000-0x00007FFAD8B91000-memory.dmp

Filesize
9.6MB

Download
memory/3872-15-0x00007FFAD81F0000-0x00007FFAD8B91000-memory.dmp

Filesize
9.6MB

Download
memory/3872-17-0x000000001C9F0000-0x000000001CA8C000-memory.dmp

Filesize
624KB

Download
memory/3872-18-0x00000000017D0000-0x00000000017D8000-memory.dmp

Filesize
32KB

Download
memory/3872-20-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-19-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-21-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-22-0x000000001FC10000-0x000000001FC72000-memory.dmp

Filesize
392KB

Download
memory/3872-13-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-25-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-34-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-35-0x00007FFAD81F0000-0x00007FFAD8B91000-memory.dmp

Filesize
9.6MB

Download
memory/3872-16-0x000000001C480000-0x000000001C94E000-memory.dmp

Filesize
4.8MB

Download
memory/3872-38-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-14-0x000000001BC30000-0x000000001BC74000-memory.dmp

Filesize
272KB

Download
memory/3872-39-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-40-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-41-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-42-0x0000000001520000-0x0000000001530000-memory.dmp

Filesize
64KB

Download
memory/3872-43-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-44-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-45-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-46-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-47-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-48-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-49-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-50-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-51-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download
memory/3872-37-0x000000001FFD0000-0x0000000021647000-memory.dmp

Filesize
22.5MB

Download

Analysis

Sharing