3477199ac35c44688a69664eb2d722607cff4e3a376a2d066eace87fe016debc

Analysis

max time kernel
175s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2008bea371f25005ce0f3aad3129d82e.exe
Size 3.6MB
Sample240102-g68laagcc4
SHA256 3477199ac35c44688a69664eb2d722607cff4e3a376a2d066eace87fe016debc
MD5 2008bea371f25005ce0f3aad3129d82e
SHA1 c2deb609326b26b8320426321bea611e412ec9b7
SHA512 19de7e1de5bdf99b5b73fe08c4a227bd6e1a734bb5a37c72333c433a126c9d55e4e5fa7a2bce53d266c34ab541d7077cf06e1e5c617d426aa3c35e9125de4474
SSDEEP 98304:NSOkORFNCFUGA8VSdcCfStASnUPSzaxEKs1ey:aORzCFUGA8VWJ1P6yaey
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2008bea371f25005ce0f3aad3129d82e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
796	chaincommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	2008bea371f25005ce0f3aad3129d82e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4392	1044	2008bea371f25005ce0f3aad3129d82e.exe	107
PID 1044 wrote to memory of 4392	1044	2008bea371f25005ce0f3aad3129d82e.exe	107
PID 1044 wrote to memory of 4392	1044	2008bea371f25005ce0f3aad3129d82e.exe	107
PID 4392 wrote to memory of 752	4392	WScript.exe	109
PID 4392 wrote to memory of 752	4392	WScript.exe	109
PID 4392 wrote to memory of 752	4392	WScript.exe	109
PID 752 wrote to memory of 796	752	cmd.exe	111
PID 752 wrote to memory of 796	752	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2008bea371f25005ce0f3aad3129d82e.exe
"C:\Users\Admin\AppData\Local\Temp\2008bea371f25005ce0f3aad3129d82e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Sessioncommon\BPWA9Mx2yNB7hHc0lxsGJMNBIzRanc.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Sessioncommon\kOMG0dmlNnfLrlS9c5whm4nSUly3D2wLIJTtAzJj9.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Sessioncommon\chaincommon.exe
      "C:\Sessioncommon/chaincommon.exe"
      4⤵
      Executes dropped EXE
      PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BPWA9Mx2yNB7hHc0lxsGJMNBIzRanc.vbe

Path C:\Sessioncommon\BPWA9Mx2yNB7hHc0lxsGJMNBIzRanc.vbe
Size 232B
SHA256 a6b06839d2f1e2e6611863e2291470e359eeed8b379f061920a940d49d84ac39
MD5 ce0e393e198df3e2027f98dc4880f731
SHA1 37e14db6526c52f61150370b70be99aca8145477
SHA512 1c9e45f2bef1d8537ddb4b4de8b3df235d2fdf5e1e97cf6cc6a3eb432a7459aee43f0d77a30d91857f28759337bde8e15a5429c82a10ad4e39e47e1b45617251
MD5 SHA1 SHA512

Submit Download

chaincommon.exe

Path C:\Sessioncommon\chaincommon.exe
Size 3.3MB
SHA256 cf619084c3885c9ccd0ed398320f8f7ea80eed81e5322a0f83c2e63ab1854842
MD5 36e7e168ee889f7668c93f069eb189c7
SHA1 16c071f10315e1bd2fb17d16528bc40519fa0d65
SHA512 7626d833afc22bb338ef1cba09091cf0b579d2f89b27c5c07e245825c170d01ba3466f00d5e4460a1efc74bf225329e930c38e90928b21ae0498f84ca910eba0
SSDEEP 98304:UOkORFNCFUGA8VSdcCfStASnUPSzaxEKs1e0:qORzCFUGA8VWJ1P6yae0
MD5 SHA1 SHA512 SSDEEP

Submit Download

kOMG0dmlNnfLrlS9c5whm4nSUly3D2wLIJTtAzJj9.bat

Path C:\Sessioncommon\kOMG0dmlNnfLrlS9c5whm4nSUly3D2wLIJTtAzJj9.bat
Size 85B
SHA256 535ed5c36cb27b8bbc0bf14d66887813089eac5546db16cd64bfac2b672e55d4
MD5 04717a3a2b2e0c31e83be2c54e77abe0
SHA1 3d61498f58629b99d65bebec6cd76223ffdde9d5
SHA512 fee78223ae625d2e5875391d45e9b580d2b0909315fafd58f600b161b0c491172eb94f372cfd2bfecd31a5370f337ad052d6dad5d56fb449753ee4618d5034e1
MD5 SHA1 SHA512

Submit Download

memory/796-12-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads