Analysis
-
max time kernel
155s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 13:33
Behavioral task
behavioral1
Sample
7a628e99bb4be11e4dc7d90c7e048ed3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7a628e99bb4be11e4dc7d90c7e048ed3.exe
Resource
win10v2004-20231215-en
General
-
Target
7a628e99bb4be11e4dc7d90c7e048ed3.exe
-
Size
755KB
-
MD5
7a628e99bb4be11e4dc7d90c7e048ed3
-
SHA1
4a778fe817f7a765edde8f52c54e78c77eb05f3a
-
SHA256
d66c418354ff17f2a4881407777b84f02bd1f3ddfaf7f4beb3203be97d0bcca5
-
SHA512
dc2e2131033b062ad3caaea23bfef891728431cd9011cfcc2607c905e58ce02428b5add4781ee3ab52a795d5cf47fac30bc4ef61bf47f54caae80e3002475a2a
-
SSDEEP
12288:xoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOqGXCJdw/oX+pd167QhEQO:2xY3NtGUmJr+4Obxd+tPZSZD/oE6EhE
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/772-0-0x0000000000400000-0x00000000004C8000-memory.dmp fakeav behavioral2/memory/772-18-0x0000000000400000-0x00000000004C8000-memory.dmp fakeav -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7a628e99bb4be11e4dc7d90c7e048ed3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 7a628e99bb4be11e4dc7d90c7e048ed3.exe -
Executes dropped EXE 1 IoCs
Processes:
KeyGen.exepid process 3208 KeyGen.exe -
Processes:
resource yara_rule C:\Windows\KeyGen.exe upx behavioral2/memory/3208-16-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3208-19-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7a628e99bb4be11e4dc7d90c7e048ed3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" 7a628e99bb4be11e4dc7d90c7e048ed3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" 7a628e99bb4be11e4dc7d90c7e048ed3.exe -
Drops file in System32 directory 2 IoCs
Processes:
7a628e99bb4be11e4dc7d90c7e048ed3.exedescription ioc process File created C:\Windows\SysWOW64\CSRLT.EXE 7a628e99bb4be11e4dc7d90c7e048ed3.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE 7a628e99bb4be11e4dc7d90c7e048ed3.exe -
Drops file in Windows directory 3 IoCs
Processes:
7a628e99bb4be11e4dc7d90c7e048ed3.exedescription ioc process File created C:\Windows\MSBLT.EXE 7a628e99bb4be11e4dc7d90c7e048ed3.exe File opened for modification C:\Windows\MSBLT.EXE 7a628e99bb4be11e4dc7d90c7e048ed3.exe File created C:\Windows\KeyGen.exe 7a628e99bb4be11e4dc7d90c7e048ed3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
KeyGen.exepid process 3208 KeyGen.exe 3208 KeyGen.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7a628e99bb4be11e4dc7d90c7e048ed3.exedescription pid process target process PID 772 wrote to memory of 3208 772 7a628e99bb4be11e4dc7d90c7e048ed3.exe KeyGen.exe PID 772 wrote to memory of 3208 772 7a628e99bb4be11e4dc7d90c7e048ed3.exe KeyGen.exe PID 772 wrote to memory of 3208 772 7a628e99bb4be11e4dc7d90c7e048ed3.exe KeyGen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a628e99bb4be11e4dc7d90c7e048ed3.exe"C:\Users\Admin\AppData\Local\Temp\7a628e99bb4be11e4dc7d90c7e048ed3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\KeyGen.exe"C:\Windows\KeyGen.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\KeyGen.exeFilesize
52KB
MD5e3c7d489013b51c671aa79c9068a2a00
SHA1deed13e52afcc9fd2ef326fb6b0aa4bf7fcf14be
SHA2565ea232ac5ebca4584f8689d5a1ed466404272a5c5496f41934537504368b5da2
SHA51218a31ffcc796d6352142374dc0e12d83b9b46d56069a5db26a38b0f6a133302f13d7064bfe9bc16e7a705aeeb2cec2d654863d92280a6085c8202a3c8096b240
-
memory/772-0-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/772-1-0x0000000001F40000-0x0000000001F41000-memory.dmpFilesize
4KB
-
memory/772-18-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/3208-16-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3208-19-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB