Analysis
-
max time kernel
119s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
4925b9c17c5c0de34eedf258f8f4f374.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4925b9c17c5c0de34eedf258f8f4f374.exe
Resource
win10v2004-20231215-en
General
-
Target
4925b9c17c5c0de34eedf258f8f4f374.exe
-
Size
202KB
-
MD5
4925b9c17c5c0de34eedf258f8f4f374
-
SHA1
0a66255b71760d6fd467ad48c7be3816e32097c9
-
SHA256
9a6a99e76ce170b6abda7ba6fbe18d492b5276db3ca68ed273de74e5cb564e42
-
SHA512
dd49fb95737b42d93cbb3359ceefaa9fcecf3c4c66f22f19207cd513e2184524db666f0641f4896a43b817740b8d40c3c0cb99066d137795f750791be68295aa
-
SSDEEP
6144:lkaoTSj1byLqohs0g7ltVXPeAayyQqxa1m:UGpbyLLhCJfkyylG
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4925b9c17c5c0de34eedf258f8f4f374.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 4925b9c17c5c0de34eedf258f8f4f374.exe -
Loads dropped DLL 4 IoCs
Processes:
4925b9c17c5c0de34eedf258f8f4f374.exerundll32.execmd.exepid process 3188 4925b9c17c5c0de34eedf258f8f4f374.exe 1168 3416 rundll32.exe 2916 cmd.exe -
Drops file in System32 directory 2 IoCs
Processes:
4925b9c17c5c0de34eedf258f8f4f374.exedescription ioc process File opened for modification C:\Windows\SysWOW64\extrfind.dll 4925b9c17c5c0de34eedf258f8f4f374.exe File opened for modification C:\Windows\system32\extrfind64.dll 4925b9c17c5c0de34eedf258f8f4f374.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4540 2916 WerFault.exe cmd.exe 1640 2916 WerFault.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4925b9c17c5c0de34eedf258f8f4f374.exepid process 3188 4925b9c17c5c0de34eedf258f8f4f374.exe 3188 4925b9c17c5c0de34eedf258f8f4f374.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4925b9c17c5c0de34eedf258f8f4f374.exedescription pid process target process PID 3188 wrote to memory of 3416 3188 4925b9c17c5c0de34eedf258f8f4f374.exe rundll32.exe PID 3188 wrote to memory of 3416 3188 4925b9c17c5c0de34eedf258f8f4f374.exe rundll32.exe PID 3188 wrote to memory of 2916 3188 4925b9c17c5c0de34eedf258f8f4f374.exe cmd.exe PID 3188 wrote to memory of 2916 3188 4925b9c17c5c0de34eedf258f8f4f374.exe cmd.exe PID 3188 wrote to memory of 2916 3188 4925b9c17c5c0de34eedf258f8f4f374.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374.exe"C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\extrfind64.dll",CreateProcessNotify2⤵
- Loads dropped DLL
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240623765.bat" "C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374.exe""2⤵
- Loads dropped DLL
PID:2916 -
C:\Windows\SysWOW64\attrib.exeattrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374.exe"3⤵
- Views/modifies file attributes
PID:4448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5243⤵
- Program crash
PID:4540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5323⤵
- Program crash
PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3188 -ip 31881⤵PID:2024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2916 -ip 29161⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2916 -ip 29161⤵PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\240623765.batFilesize
97B
MD5d226a657b279c5fc0a892748230a56ff
SHA1fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5
SHA2569dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761
SHA51207d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a
-
C:\Windows\SysWOW64\extrfind.dllFilesize
66KB
MD51b779622c0d6eec48ac0c1f3e39eb7b9
SHA1db01babafb0bbd256dca940cbe3667774e76c80a
SHA256ff0d559548eb5bcf7ee0368198cd74d2aca13b54dece875080653b677c81508a
SHA512fc88df2a55dd082a568ade994ea0eaa6a581f94e797fbe3962eaa692e43ac5403b4e817ccc011445643d690022bfbe14f580f39a06b1cab14cbef0d8091c4a34
-
C:\Windows\System32\extrfind64.dllFilesize
75KB
MD54dab557dad0fb8ec95f66d5efe648b02
SHA1b52d4d3c8429a132b7582cd8dbe89ec93da3dc05
SHA256b8a5ae38b6d38327ae2abbeb70dec6ee9ac52cdc421f5585c4907e8088eb3849
SHA5125dbc616b17578dfb4c620bcca3b040a89b5e771f34053ffe46ff449f0bea5f68f6c7db9eb7d43cddf7de7e34a94aeb29be4c2174bcec3de74a5a09a6bd70afbf
-
memory/2916-22-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/3188-2-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/3188-7-0x0000000008AD0000-0x0000000008AD1000-memory.dmpFilesize
4KB
-
memory/3188-8-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/3188-0-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3188-10-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/3188-11-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/3188-1-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/3188-23-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/3188-25-0x0000000001000000-0x0000000001035000-memory.dmpFilesize
212KB
-
memory/3416-15-0x0000018108980000-0x0000018108981000-memory.dmpFilesize
4KB