49884a80962abbb68a0e2a45a8f06a14e9d349b0d67a0fae9a2577d4ff904ca4

General

Target

456bee9ee3747079b233ae3f2bd8db71.exe
Size

61KB
MD5

456bee9ee3747079b233ae3f2bd8db71
SHA1

417b3d597b5b46f9eeb02299ef0aa3a683ed37a0
SHA256

49884a80962abbb68a0e2a45a8f06a14e9d349b0d67a0fae9a2577d4ff904ca4
SHA512

ddceb33d8eb971bc5199509b6b285634658be4b73dd714bfc309a1c51d6d793937de6f7df0e1886415dd8417e740b48be7bf21e0f6b4d543fdae427bf7719d49
SSDEEP

1536:D5NelqRZPPy83Tegj4/Bms2aFB0up4JI4OEQ5mVQ3agYd:D5NIKrimWFZpVA6mGagY

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	456bee9ee3747079b233ae3f2bd8db71.exe

Deletes itself 1 IoCs

pid	Process
4756	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
744	meakoxk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSGRAPH01 = "c:\\program files (x86)\\common files\\system\\meakoxk.exe"	meakoxk.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 4756	536	456bee9ee3747079b233ae3f2bd8db71.exe	22

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\common files\system\meakoxk.exe	456bee9ee3747079b233ae3f2bd8db71.exe
File created	\??\c:\program files (x86)\common files\system\meakoxk.exe	456bee9ee3747079b233ae3f2bd8db71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
744	meakoxk.exe
744	meakoxk.exe
744	meakoxk.exe
744	meakoxk.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	536	456bee9ee3747079b233ae3f2bd8db71.exe
Token: SeIncBasePriorityPrivilege	536	456bee9ee3747079b233ae3f2bd8db71.exe
Token: 33	744	meakoxk.exe
Token: SeIncBasePriorityPrivilege	744	meakoxk.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 744	536	456bee9ee3747079b233ae3f2bd8db71.exe	23
PID 536 wrote to memory of 744	536	456bee9ee3747079b233ae3f2bd8db71.exe	23
PID 536 wrote to memory of 744	536	456bee9ee3747079b233ae3f2bd8db71.exe	23
PID 536 wrote to memory of 4756	536	456bee9ee3747079b233ae3f2bd8db71.exe	22
PID 536 wrote to memory of 4756	536	456bee9ee3747079b233ae3f2bd8db71.exe	22
PID 536 wrote to memory of 4756	536	456bee9ee3747079b233ae3f2bd8db71.exe	22
PID 536 wrote to memory of 4756	536	456bee9ee3747079b233ae3f2bd8db71.exe	22
PID 744 wrote to memory of 3528	744	meakoxk.exe	49
PID 744 wrote to memory of 3528	744	meakoxk.exe	49
PID 744 wrote to memory of 3528	744	meakoxk.exe	49
PID 744 wrote to memory of 3528	744	meakoxk.exe	49

C:\Users\Admin\AppData\Local\Temp\456bee9ee3747079b233ae3f2bd8db71.exe
"C:\Users\Admin\AppData\Local\Temp\456bee9ee3747079b233ae3f2bd8db71.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:4756
- C:\program files (x86)\common files\system\meakoxk.exe
  "C:\program files (x86)\common files\system\meakoxk.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:744

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\meakoxk.exe

Filesize
19KB

MD5
e1d4df41243831114f6c82b3addec096

SHA1
8dee9ef71a1eb1423eaf3338d91746420a4d906a

SHA256
b2f73975371544a738a12901ef9090fdf74b3b1a675cfde883040ba3143d7dc1

SHA512
1168e90ade32d6ec7cb691926708b1e5d9156bb014d03bfa8e5bb65b2ddbb90a0884d75320cf0495382ae501efc10c62f9c42eb6de7e6b95e0a414dea06aa6a7

Download Submit
C:\Program Files (x86)\Common Files\System\meakoxk.exe

Filesize
61KB

MD5
456bee9ee3747079b233ae3f2bd8db71

SHA1
417b3d597b5b46f9eeb02299ef0aa3a683ed37a0

SHA256
49884a80962abbb68a0e2a45a8f06a14e9d349b0d67a0fae9a2577d4ff904ca4

SHA512
ddceb33d8eb971bc5199509b6b285634658be4b73dd714bfc309a1c51d6d793937de6f7df0e1886415dd8417e740b48be7bf21e0f6b4d543fdae427bf7719d49

Download Submit
memory/536-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/536-1-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download
memory/536-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/744-14-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download
memory/744-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads