Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 23:41
Static task
static1
Behavioral task
behavioral1
Sample
4cc2a7ec4391819c1cb4934749891d47.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cc2a7ec4391819c1cb4934749891d47.exe
Resource
win10v2004-20231222-en
General
-
Target
4cc2a7ec4391819c1cb4934749891d47.exe
-
Size
2.1MB
-
MD5
4cc2a7ec4391819c1cb4934749891d47
-
SHA1
5c42e67be5599f39f3c26c22db465a2caaf990fe
-
SHA256
1e32e37f0155798afe17b899df50d1071cd0d82efacbcf3459c5547764624cd6
-
SHA512
cf146fee4e03965a17beabfac7a9dec43fd118c63ad9de979ceb7abde5524d4caf9def92c389e4b63f4d95599514d5e2ec519926f9ec5cf4792425783f33e251
-
SSDEEP
49152:D6qN8ilbrEnWgKPW7b9L+Cpg4yy+xHE6R4dL/g17kfCnBt2uThJ:DVvskgB+Cut5E3dLhCnmuThJ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4cc2a7ec4391819c1cb4934749891d47.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 4cc2a7ec4391819c1cb4934749891d47.exe -
Executes dropped EXE 1 IoCs
Processes:
na90xb4l8128bo7.exepid process 3700 na90xb4l8128bo7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4cc2a7ec4391819c1cb4934749891d47.exedescription pid process target process PID 4384 wrote to memory of 3700 4384 4cc2a7ec4391819c1cb4934749891d47.exe na90xb4l8128bo7.exe PID 4384 wrote to memory of 3700 4384 4cc2a7ec4391819c1cb4934749891d47.exe na90xb4l8128bo7.exe PID 4384 wrote to memory of 3700 4384 4cc2a7ec4391819c1cb4934749891d47.exe na90xb4l8128bo7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc2a7ec4391819c1cb4934749891d47.exe"C:\Users\Admin\AppData\Local\Temp\4cc2a7ec4391819c1cb4934749891d47.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\na90xb4l8128bo7.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\na90xb4l8128bo7.exe" -e -p080wq4n75l2kqd42⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\filesystemscan.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\filesystemscan.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Protector-lai.exeC:\Users\Admin\AppData\Roaming\Protector-lai.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\FILESY~1.EXE" >> NUL1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-100-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/2116-20-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/2116-28-0x00000000036B0000-0x00000000036B1000-memory.dmpFilesize
4KB
-
memory/2116-70-0x0000000003F10000-0x0000000003F11000-memory.dmpFilesize
4KB
-
memory/2116-78-0x0000000003F20000-0x0000000003F21000-memory.dmpFilesize
4KB
-
memory/2116-77-0x0000000003EF0000-0x0000000003EF1000-memory.dmpFilesize
4KB
-
memory/2116-76-0x0000000003ED0000-0x0000000003ED1000-memory.dmpFilesize
4KB
-
memory/2116-75-0x0000000003E40000-0x0000000003E41000-memory.dmpFilesize
4KB
-
memory/2116-74-0x0000000003D00000-0x0000000003D01000-memory.dmpFilesize
4KB
-
memory/2116-80-0x00000000043E0000-0x00000000043E1000-memory.dmpFilesize
4KB
-
memory/2116-103-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB
-
memory/2116-81-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/2116-79-0x00000000043F0000-0x00000000043F1000-memory.dmpFilesize
4KB
-
memory/2116-72-0x0000000003710000-0x0000000003711000-memory.dmpFilesize
4KB
-
memory/2116-73-0x0000000003950000-0x0000000003951000-memory.dmpFilesize
4KB
-
memory/2116-71-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/2116-69-0x0000000003EE0000-0x0000000003EE1000-memory.dmpFilesize
4KB
-
memory/2116-68-0x0000000003EC0000-0x0000000003EC1000-memory.dmpFilesize
4KB
-
memory/2116-67-0x0000000003E80000-0x0000000003E81000-memory.dmpFilesize
4KB
-
memory/2116-66-0x0000000003EB0000-0x0000000003EB1000-memory.dmpFilesize
4KB
-
memory/2116-65-0x0000000003E90000-0x0000000003E91000-memory.dmpFilesize
4KB
-
memory/2116-64-0x0000000003EA0000-0x0000000003EA1000-memory.dmpFilesize
4KB
-
memory/2116-63-0x0000000003E60000-0x0000000003E61000-memory.dmpFilesize
4KB
-
memory/2116-62-0x0000000003E70000-0x0000000003E71000-memory.dmpFilesize
4KB
-
memory/2116-61-0x0000000003CF0000-0x0000000003CF1000-memory.dmpFilesize
4KB
-
memory/2116-60-0x0000000003990000-0x0000000003991000-memory.dmpFilesize
4KB
-
memory/2116-59-0x00000000039A0000-0x00000000039A1000-memory.dmpFilesize
4KB
-
memory/2116-58-0x0000000003960000-0x0000000003961000-memory.dmpFilesize
4KB
-
memory/2116-57-0x0000000003970000-0x0000000003971000-memory.dmpFilesize
4KB
-
memory/2116-56-0x0000000003940000-0x0000000003941000-memory.dmpFilesize
4KB
-
memory/2116-55-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/2116-54-0x0000000003930000-0x0000000003931000-memory.dmpFilesize
4KB
-
memory/2116-53-0x0000000003900000-0x0000000003901000-memory.dmpFilesize
4KB
-
memory/2116-52-0x0000000003910000-0x0000000003911000-memory.dmpFilesize
4KB
-
memory/2116-51-0x00000000038F0000-0x00000000038F1000-memory.dmpFilesize
4KB
-
memory/2116-50-0x00000000038C0000-0x00000000038C1000-memory.dmpFilesize
4KB
-
memory/2116-49-0x00000000038D0000-0x00000000038D1000-memory.dmpFilesize
4KB
-
memory/2116-48-0x00000000038A0000-0x00000000038A1000-memory.dmpFilesize
4KB
-
memory/2116-47-0x00000000038B0000-0x00000000038B1000-memory.dmpFilesize
4KB
-
memory/2116-46-0x0000000003880000-0x0000000003881000-memory.dmpFilesize
4KB
-
memory/2116-45-0x0000000003890000-0x0000000003891000-memory.dmpFilesize
4KB
-
memory/2116-44-0x0000000003720000-0x0000000003721000-memory.dmpFilesize
4KB
-
memory/2116-43-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/2116-42-0x0000000003700000-0x0000000003701000-memory.dmpFilesize
4KB
-
memory/2116-41-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/2116-40-0x00000000036F0000-0x00000000036F1000-memory.dmpFilesize
4KB
-
memory/2116-39-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/2116-38-0x00000000036D0000-0x00000000036D1000-memory.dmpFilesize
4KB
-
memory/2116-37-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/2116-36-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/2116-35-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/2116-34-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/2116-33-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/2116-32-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/2116-31-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/2116-30-0x00000000036C0000-0x00000000036C1000-memory.dmpFilesize
4KB
-
memory/2116-29-0x0000000003650000-0x0000000003652000-memory.dmpFilesize
8KB
-
memory/2116-27-0x00000000038E0000-0x00000000038E1000-memory.dmpFilesize
4KB
-
memory/2116-26-0x0000000003660000-0x0000000003663000-memory.dmpFilesize
12KB
-
memory/2116-25-0x0000000003670000-0x0000000003671000-memory.dmpFilesize
4KB
-
memory/2116-24-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/2116-23-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/2116-22-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/2116-21-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/2116-19-0x0000000002660000-0x00000000026BA000-memory.dmpFilesize
360KB
-
memory/2116-18-0x0000000000400000-0x0000000000832000-memory.dmpFilesize
4.2MB