69bc33a4aec01f84eeee4bcccf312cc8ebfd7a4e5164f0d5a88279a9b16d6f58

General

Target

58b10193041261d1459fc7a38e4f7182.exe
Size

63KB
MD5

58b10193041261d1459fc7a38e4f7182
SHA1

697a818590fb22c5f050bc6fe2e09bcd9b2c533d
SHA256

69bc33a4aec01f84eeee4bcccf312cc8ebfd7a4e5164f0d5a88279a9b16d6f58
SHA512

5d8c5622ab866c0fc7e806f7599c994897802bcc9158d3aa80f678777a1c030d2a5aaec475869fc493edf8ec1225979f68c3ba25aa71814534c7b0e7798628f6
SSDEEP

1536:on1bEkVY3D3+RyK/vpKl/WYEQxirnHZi0svY1Jnpv/mu:mbEm8DukK/vgc6QH2g/r

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	58b10193041261d1459fc7a38e4f7182.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5845.exe

Executes dropped EXE 5 IoCs

pid	Process
1276	msreg.exe
1976	5845.exe
1440	5845.exe
3600	svchosts.exe
4412	svchostc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msreg.exe = "C:\\Windows\\msreg.exe"	58b10193041261d1459fc7a38e4f7182.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\putil = "C:\\Windows\\5845.exe"	5845.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	5845.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	58b10193041261d1459fc7a38e4f7182.exe
File created	C:\Windows\SysWOW64\5845.exe	58b10193041261d1459fc7a38e4f7182.exe
File created	C:\Windows\SysWOW64\a.bat	5845.exe
File created	C:\Windows\SysWOW64\svchostc.exe	58b10193041261d1459fc7a38e4f7182.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\msreg.exe	58b10193041261d1459fc7a38e4f7182.exe
File created	C:\Windows\5845.exe	5845.exe
File opened for modification	C:\Windows\5845.exe	5845.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1276	5052	58b10193041261d1459fc7a38e4f7182.exe	91
PID 5052 wrote to memory of 1276	5052	58b10193041261d1459fc7a38e4f7182.exe	91
PID 5052 wrote to memory of 1276	5052	58b10193041261d1459fc7a38e4f7182.exe	91
PID 5052 wrote to memory of 1976	5052	58b10193041261d1459fc7a38e4f7182.exe	96
PID 5052 wrote to memory of 1976	5052	58b10193041261d1459fc7a38e4f7182.exe	96
PID 5052 wrote to memory of 1976	5052	58b10193041261d1459fc7a38e4f7182.exe	96
PID 1976 wrote to memory of 1440	1976	5845.exe	95
PID 1976 wrote to memory of 1440	1976	5845.exe	95
PID 1976 wrote to memory of 1440	1976	5845.exe	95
PID 1976 wrote to memory of 1212	1976	5845.exe	94
PID 1976 wrote to memory of 1212	1976	5845.exe	94
PID 1976 wrote to memory of 1212	1976	5845.exe	94
PID 1276 wrote to memory of 3600	1276	msreg.exe	109
PID 1276 wrote to memory of 3600	1276	msreg.exe	109
PID 1276 wrote to memory of 3600	1276	msreg.exe	109
PID 1276 wrote to memory of 4412	1276	msreg.exe	112
PID 1276 wrote to memory of 4412	1276	msreg.exe	112
PID 1276 wrote to memory of 4412	1276	msreg.exe	112

C:\Users\Admin\AppData\Local\Temp\58b10193041261d1459fc7a38e4f7182.exe
"C:\Users\Admin\AppData\Local\Temp\58b10193041261d1459fc7a38e4f7182.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\msreg.exe
  "C:\Windows\msreg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\svchosts.exe
    svchosts.exe -p24759
    3⤵
    - Executes dropped EXE
    PID:3600
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p14728
    3⤵
    - Executes dropped EXE
    PID:4412
- C:\Windows\SysWOW64\5845.exe
  "C:\Windows\system32\5845.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\SysWOW64\a.bat" "C:\Windows\SysWOW64\5845.exe""
1⤵
PID:1212

C:\Windows\5845.exe
"C:\Windows\5845.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\5845.exe

Filesize
7KB

MD5
92b106420d9cc35374e809dc8fe852f7

SHA1
22e1cb6d2415deb60472ffe10ec06cbc4804b66b

SHA256
1b188f82bf3b9bf44a35c1111136d770b554d2ae85dd9af81aceb6ac2e926eac

SHA512
85b0fff543a0290aca4d3b2c3c155b2ce3e675d533b2de2cf65ca24a16176cc7f7ef12ba9c830974156921b275772fa815f40c330b897097dd97f611f90a85ba

Download Submit
C:\Windows\SysWOW64\a.bat

Filesize
38B

MD5
50a94effec08179504ef46949486ef63

SHA1
c36bcfbc6d85d0ae7b5642655985ecc2ab1f9e1d

SHA256
149194e913c7900de706a6a48db7695059b91fd63ebc75b373355c7009fb62e2

SHA512
095c1914e290377676cfbf07c52fb321d8e51638229810e560447e4db51d2e4dff8bfa870b009029692e12c0b9fe9c1fcf74dde30c3f68297631ff4ea6bbe283

Download Submit
C:\Windows\SysWOW64\svchostc.exe

Filesize
15KB

MD5
c439458fe4dfa9bc61d7901010c70f2d

SHA1
6169767b230a997423f6ea700249595bdf0d9dfd

SHA256
fd66eadcecc665ff52db488fbda69224bd9ada9230d7bd7d70fe3955428f2cdb

SHA512
177f1a3cac0cec930d4ed6e3979eae3dcc26606d46e39038d1f0ac8bae8132d18037972e1e3b923adeb18c7c07f909b0aa01dbdf914e7991af9bfc80eee51815

Download Submit
C:\Windows\SysWOW64\svchosts.exe

Filesize
20KB

MD5
6aa3069d49df47e0758b56fd96842f4f

SHA1
f883e5f1beb4e0b045f17502c2f3360e1968d199

SHA256
96c4145afcf8aa0dd783003cb382431093eae04d66d3a9534cecc9b3cf23b8c7

SHA512
16a36768c5297cde7e5edcad4f7416e838b75ce8825e5127434b56bcd30c5d3d62e4b700f7c86479d912681a0a528a9cf6f3c6b6ce54c67f14218f56e2d91589

Download Submit
C:\Windows\msreg.exe

Filesize
4KB

MD5
49bf33e2095037be496a3f1b32870a68

SHA1
ae1007e66a72417b41d920d310f7eaed136fc505

SHA256
b5f35a38774e79da832e33aa57bd97230eac89bc174a1a36c02a89497717cd19

SHA512
d718adedcc5454603356020b189bf649cb2039fe923751498c00fc784fc7856ecc645429a603676a88eab859ba915e199df8bf7d03344aee3de9a568c1595635

Download Submit
memory/1276-65-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1276-35-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1276-39-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1276-53-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1440-36-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1976-33-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3600-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4412-68-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5052-21-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads