Analysis
-
max time kernel
103s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:22
Static task
static1
Behavioral task
behavioral1
Sample
74f55a30c3d053109039d1323ab64db1.exe
Resource
win7-20231215-en
General
-
Target
74f55a30c3d053109039d1323ab64db1.exe
-
Size
1.5MB
-
MD5
74f55a30c3d053109039d1323ab64db1
-
SHA1
2c119dae3c57c7e4a5e0a893bed9e01a3e228256
-
SHA256
04c6c07e6af92c6148453cba27fa286afe905b87fef3e35121bb259e20484fe3
-
SHA512
b8944ebfa643611ff3def0a9680c0775d3947640c2ef653becbf19cd2eaa8a0a145cecff454be391b5bed53778c16dccf701e1561c9246974100b1f4e72f2af2
-
SSDEEP
24576:BSLXeYCOLvNSj7bl/narnAN+fhB9tDtrxS7ECq8yvO1xLjYAR4ghdKNIz7xrVKE:qxLvoxCrnfhtrxBRmLAa4ghkoNVKE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74f55a30c3d053109039d1323ab64db1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 74f55a30c3d053109039d1323ab64db1.exe -
Drops startup file 1 IoCs
Processes:
Confusa.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TnFhPPruMZ.url Confusa.exe.com -
Executes dropped EXE 3 IoCs
Processes:
Confusa.exe.comConfusa.exe.comRegAsm.exepid process 2620 Confusa.exe.com 1924 Confusa.exe.com 1152 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Confusa.exe.comdescription pid process target process PID 1924 set thread context of 1152 1924 Confusa.exe.com RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
74f55a30c3d053109039d1323ab64db1.execmd.execmd.exeConfusa.exe.comConfusa.exe.comdescription pid process target process PID 4300 wrote to memory of 2660 4300 74f55a30c3d053109039d1323ab64db1.exe dllhost.exe PID 4300 wrote to memory of 2660 4300 74f55a30c3d053109039d1323ab64db1.exe dllhost.exe PID 4300 wrote to memory of 2660 4300 74f55a30c3d053109039d1323ab64db1.exe dllhost.exe PID 4300 wrote to memory of 2704 4300 74f55a30c3d053109039d1323ab64db1.exe cmd.exe PID 4300 wrote to memory of 2704 4300 74f55a30c3d053109039d1323ab64db1.exe cmd.exe PID 4300 wrote to memory of 2704 4300 74f55a30c3d053109039d1323ab64db1.exe cmd.exe PID 2704 wrote to memory of 4516 2704 cmd.exe cmd.exe PID 2704 wrote to memory of 4516 2704 cmd.exe cmd.exe PID 2704 wrote to memory of 4516 2704 cmd.exe cmd.exe PID 4516 wrote to memory of 228 4516 cmd.exe findstr.exe PID 4516 wrote to memory of 228 4516 cmd.exe findstr.exe PID 4516 wrote to memory of 228 4516 cmd.exe findstr.exe PID 4516 wrote to memory of 2620 4516 cmd.exe Confusa.exe.com PID 4516 wrote to memory of 2620 4516 cmd.exe Confusa.exe.com PID 4516 wrote to memory of 2620 4516 cmd.exe Confusa.exe.com PID 4516 wrote to memory of 2752 4516 cmd.exe PING.EXE PID 4516 wrote to memory of 2752 4516 cmd.exe PING.EXE PID 4516 wrote to memory of 2752 4516 cmd.exe PING.EXE PID 2620 wrote to memory of 1924 2620 Confusa.exe.com Confusa.exe.com PID 2620 wrote to memory of 1924 2620 Confusa.exe.com Confusa.exe.com PID 2620 wrote to memory of 1924 2620 Confusa.exe.com Confusa.exe.com PID 1924 wrote to memory of 1152 1924 Confusa.exe.com RegAsm.exe PID 1924 wrote to memory of 1152 1924 Confusa.exe.com RegAsm.exe PID 1924 wrote to memory of 1152 1924 Confusa.exe.com RegAsm.exe PID 1924 wrote to memory of 1152 1924 Confusa.exe.com RegAsm.exe PID 1924 wrote to memory of 1152 1924 Confusa.exe.com RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f55a30c3d053109039d1323ab64db1.exe"C:\Users\Admin\AppData\Local\Temp\74f55a30c3d053109039d1323ab64db1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵PID:2660
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Cheope.doc2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^kyZlEtGjnpcqijZRnzmJfibEXwOUCZPwNEUspUFNAJeaxwweJgqikaitIxjDfMKmxzjDsHIDOMpFtypVZLkhYIQxvQJOIwbOZCYqPnLwGvampC$" All.doc4⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Confusa.exe.comConfusa.exe.com u4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Confusa.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Confusa.exe.com u5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe6⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\PING.EXEping localhost -n 304⤵
- Runs ping.exe
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\All.docFilesize
758KB
MD5ae62a95e5ca14fd4f39d4db8784bb56f
SHA1cc2c96f598506e755947a5d85c88d770dcd687fe
SHA256034eda6f0505e9e180fe5c8a331decd062bca1be4d1c480384e6586f5c23151f
SHA5126d56cb41811b81f32e33116ce3ec136e1cd924795efa277f4248d04c2ad40dd5f992d88052f9bdf70f36f45d0e3377e513e2499a20f3b7b5a707cb6dd10c3ce8
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Cheope.docFilesize
514B
MD52cf2d38952e20d5a38eee76316c81644
SHA1dd8c2b47d43e30b3c76bc2b55e3ae8849b2cd7c7
SHA2566d55c444f8ad79e9dd4f48756d50d205e5b255db8f1e5c390fc199bcae518959
SHA51285118f3bc47b362db456af5398b789c4a6f48eee655dec0c3f3012cc1d4d05561e5127f603e07263ada9e6a441541408df12265742e78d1125b2609484098fce
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Confusa.exe.comFilesize
146KB
MD502c0a77b4377e7ba47cb731c70549db0
SHA19d12f04acd939f5f02a9ee475e8482bfd8719e22
SHA256d84c9864a75444196438dc78370124f2cef3ec87b31e6aa6f5416084a7d4d35f
SHA512c6c924b8b9ca0e78ff8de88b2691b44177f638210c284b956a337d86aad29b9ea8a1ff22e8c43728a555b963fd05ca16efb728e790b93fe25e188e22381addd1
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Confusa.exe.comFilesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Crede.docFilesize
568KB
MD557ea490f060e16dd2ca81d9bb5cdf286
SHA11f0f2329d504f2bbc8a19751803e9d77c7d9cd66
SHA256e858500baed65c1f3857e1b7546f8181e9db77a70aca39875edccaadebc9337e
SHA512fb7226176c76c5afaa6aed1e7a88d9a11baf1465ca8d68a782a6a3dd2f1048e0ddf22c5997f645291a9daa761c2393e0acde40ae6ccee244bc8839b30f5b67c2
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dal.docFilesize
250KB
MD527a5b778f6c4e2f6ccc658722c09c9c8
SHA1aa44feb27e6c08fdb686bad7b0ddc67ad4d81ac1
SHA25602f040fef47384514ceda1f22ec30ce55a6b37ba7f61bef3935e7f9a07c57fcc
SHA51279761e399705b877aad544c1169ca4d9560674dfc9e04bd8c6abbdf5161e28a613eac72a92b4a16ee0aee77fe354f6100e3ecafdbd4c96526b85616237df5390
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\uFilesize
205KB
MD5ad7ed69b5cd8282ce13d9a6364aa30fd
SHA1604ad8b7f955443e40146971e24f79c64461542d
SHA256a22ee2c86a2fd045be47f2fd6e56366b0a4d5de2b1eb3c665b20e0a0fae43439
SHA512a1cc3553a871c2fce6e9be35ff10a2af9de177ed5ea0556f9088a41186a8ac8f43fc76065d797e082e1fe2e33fa2cc5e0c7a01e7ca86b992f1c8222958929866
-
C:\Users\Admin\AppData\Roaming\wrRnsGDkrW\sFilesize
988KB
MD5b06ae64571406664375919ff977f6706
SHA1ec86e42ff636bd894ca903c2acee26b99b0271f7
SHA2563c06347aa0072594f89e799df49325bd4b3e0532c11199505a30f4d600ebfea3
SHA512259d7a4260a1c542885bbc71f100d0b3d59550b1fd9173aa368d133436c140ac582cf8e67b04fd38071ebc4be419abd18a602d4204bdf8fac3fad865337a1e37
-
memory/1152-38-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/1152-39-0x0000000004F10000-0x0000000004F76000-memory.dmpFilesize
408KB
-
memory/1152-34-0x0000000072C10000-0x00000000733C0000-memory.dmpFilesize
7.7MB
-
memory/1152-35-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB
-
memory/1152-36-0x0000000004DD0000-0x0000000004E6C000-memory.dmpFilesize
624KB
-
memory/1152-37-0x0000000005040000-0x0000000005202000-memory.dmpFilesize
1.8MB
-
memory/1152-45-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/1152-30-0x0000000000820000-0x00000000008B4000-memory.dmpFilesize
592KB
-
memory/1152-41-0x0000000005210000-0x0000000005248000-memory.dmpFilesize
224KB
-
memory/1152-42-0x0000000005890000-0x0000000005906000-memory.dmpFilesize
472KB
-
memory/1152-40-0x0000000004FB0000-0x0000000004FDE000-memory.dmpFilesize
184KB
-
memory/1152-43-0x00000000052B0000-0x00000000052C0000-memory.dmpFilesize
64KB
-
memory/1152-44-0x0000000072C10000-0x00000000733C0000-memory.dmpFilesize
7.7MB
-
memory/1924-28-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB