24a4594da23c10c8368275d1f75e95fe5436a46212aaaea94dc9a40f90672ceb

General

Target

5c9d162fe3c5a63ab017b121ec6b0c82.exe
Size

178KB
MD5

5c9d162fe3c5a63ab017b121ec6b0c82
SHA1

e03b693182e19e21c9a1e0f72d85f047b27f5c20
SHA256

24a4594da23c10c8368275d1f75e95fe5436a46212aaaea94dc9a40f90672ceb
SHA512

37e6efa0855f5b2a0957fc0245e71c372ac9f0bf3372edc204492338727788fa0ae3860bc5059f247e8a153e68a5d480af4553b17a853a17f566d0ec12f2f0a7
SSDEEP

3072:8d9xR3G2BZMbBLBaYw0coLujNHOFbA1BnJkM9B6jQxwv8YC5z41Lk:8d93ZBZMbqYgomHOFbA1BnJhB68xvF5B

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5c9d162fe3c5a63ab017b121ec6b0c82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Erkslfa.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dotop.nlp	Erkslfa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dotop.nlp	Erkslfa.exe

Executes dropped EXE 1 IoCs

pid	Process
828	Erkslfa.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nlp.reg	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\Windows\TKLobby.ico	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\Erkslfa.exe	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\windows\Dotop.nlp	Erkslfa.exe
File created	C:\Windows\nlp.reg	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\TKLobby.ico	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\Windows\config.ini	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File opened for modification	C:\Windows\config.ini	5c9d162fe3c5a63ab017b121ec6b0c82.exe
File created	C:\Windows\Erkslfa.exe	5c9d162fe3c5a63ab017b121ec6b0c82.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ = "lnkfile"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214F9-0000-0000-C000-000000000046}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214EE-0000-0000-C000-000000000046}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{00021500-0000-0000-C000-000000000046}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellNew\Command = "rundll32.exe appwiz.cpl,NewLinkHere %1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nlp\ShellNew	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3720	regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 828	2524	5c9d162fe3c5a63ab017b121ec6b0c82.exe	93
PID 2524 wrote to memory of 828	2524	5c9d162fe3c5a63ab017b121ec6b0c82.exe	93
PID 2524 wrote to memory of 828	2524	5c9d162fe3c5a63ab017b121ec6b0c82.exe	93
PID 828 wrote to memory of 3720	828	Erkslfa.exe	95
PID 828 wrote to memory of 3720	828	Erkslfa.exe	95
PID 828 wrote to memory of 3720	828	Erkslfa.exe	95

C:\Users\Admin\AppData\Local\Temp\5c9d162fe3c5a63ab017b121ec6b0c82.exe
"C:\Users\Admin\AppData\Local\Temp\5c9d162fe3c5a63ab017b121ec6b0c82.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2524
- C:\windows\Erkslfa.exe
  "C:\windows\Erkslfa.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /s C:\windows\nlp.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dotop.nlp

Filesize
1KB

MD5
0f254bd12795c80c8bd648531bcd19bc

SHA1
e5bf7763a6798c886b5a371380f20ebc039b0324

SHA256
c843882f4fd5e53cdbbae481c7fe5bf66f2baaf2d598275ea9d57eb1a06ed3c0

SHA512
6c5801475ffbdb2c68054758295fba636b0c917ab7f0fdf1427f491f7a9896323e63098e38b168cde3b2353dfcbb5cf09c1242250724f3d3c2b1746db53ffeef

Download Submit
C:\Windows\Erkslfa.exe

Filesize
178KB

MD5
c5be0c0f188a5fb75928baba0f046655

SHA1
4b531d58d691ede8004f0dc3cc60c5188d0005b5

SHA256
8f8fecdf1c66eb0da8d3e1163247f1880ed285c33afc005e12b5a4985b5b82c4

SHA512
2d2c87a265e7a6ba3e24b26f523fbf23f16a50bf40e45b6779707923380f5b484e5ff19876a791156727b2e5167241cd3c415f8074543a93d42f675415180600

Download Submit
C:\Windows\nlp.reg

Filesize
1KB

MD5
03c8bdd1de2c4b9a1d3e633c2291cabd

SHA1
d263605f8f6eaa1c067b1e0d0ecb9d3acdd056b7

SHA256
fa1425b7727b215c37a93f9664ff23a6d7d00cf51159c3be76a032df1bbbcf2e

SHA512
2fd3524524852d12acace07d7028893c4378c8dfbc9fcf56ea0a093a239335d66afccb122566fe0505daf14d0ff3aecc813a55f177447614460277d04860afb8

Download Submit
C:\windows\config.ini

Filesize
73B

MD5
9181157a5c6e6d271167f056c916e138

SHA1
ca09fd827a63758438098d9068977ceabcf3d301

SHA256
877af9dd2c1aaa07c3fc9780fa0610a677d97d26e5656d15c72715754a7a0376

SHA512
661e185451d0e241445454ce5230f740455987ccc0fb6d4d5df3af40de3d8814add178b9accbcd86bc18f1b8b4755f69d19133f593d215407bb4ad6572a98222

Download Submit
memory/828-25-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/828-38-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2524-15-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing