5a956f59fa05ddaf95fe7c450f0334f206d1d4cb7fb489123d1fc2a9e77e7706

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
956162690911384419ce8bd997391dc3.exe
Size 1.3MB
Sample240206-y3e81afce9
SHA256 5a956f59fa05ddaf95fe7c450f0334f206d1d4cb7fb489123d1fc2a9e77e7706
MD5 956162690911384419ce8bd997391dc3
SHA1 5fcd30bcff3f32c29ee7172a005e04a56514b655
SHA512 988e060fdfdcca4ab917a9c54d9920094aea2f3bd9c2b964cfc16819baa4252d5d0fb1f2e310dcd3c218ac13bb2e34e57b87243e2dc60684b83f141911196c55
SSDEEP 24576:2emoyx4OCgRUnuZ1SQ8mqeT7UlP4ri0xq3Gf7C8PShPKkI/23sz:29i6k2kGiT3eO8PJ/Isz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2 vmprotect

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000023208-15.dat	aspack_v212_v242
behavioral2/files/0x0006000000023208-19.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	956162690911384419ce8bd997391dc3.exe

Executes dropped EXE 2 IoCs

pid	Process
1368	DNFÒ°ÀÇ.exe
2744	hao66.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x00090000000231f3-5.dat	vmprotect
behavioral2/files/0x00090000000231f3-12.dat	vmprotect
behavioral2/memory/1368-17-0x0000000000400000-0x00000000006CF000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	2744	WerFault.exe	85

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1368	DNFÒ°ÀÇ.exe
1368	DNFÒ°ÀÇ.exe
1368	DNFÒ°ÀÇ.exe
1368	DNFÒ°ÀÇ.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1368	4760	956162690911384419ce8bd997391dc3.exe	84
PID 4760 wrote to memory of 1368	4760	956162690911384419ce8bd997391dc3.exe	84
PID 4760 wrote to memory of 1368	4760	956162690911384419ce8bd997391dc3.exe	84
PID 4760 wrote to memory of 2744	4760	956162690911384419ce8bd997391dc3.exe	85
PID 4760 wrote to memory of 2744	4760	956162690911384419ce8bd997391dc3.exe	85
PID 4760 wrote to memory of 2744	4760	956162690911384419ce8bd997391dc3.exe	85

C:\Users\Admin\AppData\Local\Temp\956162690911384419ce8bd997391dc3.exe
"C:\Users\Admin\AppData\Local\Temp\956162690911384419ce8bd997391dc3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\DNFÒ°ÀÇ.exe
  "C:\DNFÒ°ÀÇ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1368
- C:\hao66.exe
  "C:\hao66.exe"
  2⤵
  - Executes dropped EXE
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 284
    3⤵
    - Program crash
    PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2744 -ip 2744
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DNFÒ°ÀÇ.exe

Path C:\DNFÒ°ÀÇ.exe
Size 251KB
SHA256 e33bdf82449488e8626ff181b0de5e6bfaf7a7b60a72aef45e643170a82435f4
MD5 7239b2ff6d2df4c8d4babefa61be1d10
SHA1 0661ee9ca38d2d7b9f546fa76021e59f13c7411e
SHA512 2abe99ade162670f5dcbb1bbdb7ea971abc5af27c215262700b6d46581896ff911b9453e292b8ab57cd6262ab76a9fbac1bc9bd86c59ad233046397220ff6a55
SSDEEP 6144:Lds50OgVV8Ad1vgnXYLYKbJ2VLbKaGsJbT:1v/HAYUKbMVLbKCl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DNFÒ°ÀÇ.exe

Path C:\DNFÒ°ÀÇ.exe
Size 1.2MB
SHA256 ba5d49daa87064ce6faff800aa27dd87b1bb0ca3c23214e2260fc069f09a3941
MD5 198344bcb27bfba9ce3548337caec038
SHA1 8589cbb6f91270f95a24197c019e25acb431f2cf
SHA512 e11dd67c258af49ba4be595c5dcbeb1f3330bb5c8280d2b10ff3442690c888b006a2fe2fc51870528c37f16020cf9c123b8aa059d33843edfa7d5424e07ca809
SSDEEP 24576:1v/67JTAUDzd3QpQ9MGgw+MkhPGVk93gJmUtlgQD9zm:1679AUDRpM+kJGk9wJrzgm9z
MD5 SHA1 SHA512 SSDEEP

Submit Download

hao66.exe

Path C:\hao66.exe
Size 64KB
SHA256 b8fdcdbe0c3598f245c01ab39ad53b45eb2eca4f670e39bc9079c4c8226a301e
MD5 ac9fde77d76fe757737b891539b3c595
SHA1 45804cda6b9259bf0c95ef7805d6bba426a1f2d9
SHA512 dd4cec64ba4061ec7fadbf07fbff0f96864c54d1e8b0c9ef9a372cf099c2bafd2704808490b61944e66d8e12aec6d312c931f69fc2481980c4d947d99455acd4
SSDEEP 1536:dgo4rUxDJFw92tCWTc0JRbeg3kqmqo1hqUk8GOY:Ootjw92t+0fbT3nmqeMOY
MD5 SHA1 SHA512 SSDEEP

Submit Download

hao66.exe

Path C:\hao66.exe
Size 99KB
SHA256 cb59430f11f30e65b5f52e8c2594246a276b72d8df4ab102a435c83b381c78c8
MD5 f61500ddc7ad7f58ae3567998c818624
SHA1 e511159f3fa9cfc5b3f396308a2eb5889fb50411
SHA512 4c6aaf2d3b854aa82d37c62c8320f49113d724f59fb3f3f895b75b9fe0542c9bcd242871d01dbb544b5705bf7daf4364b003377484b7699eed271e58253c3d8b
SSDEEP 1536:dgo4rUxDJFw92tCWTc0JRbeg3kqmqo1hqUk8GO1qfocva3vSTG8uSLftHWJNE7n:Ootjw92t+0fbT3nmqeMORdakSDtOgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-17-0x0000000000400000-0x00000000006CF000-memory.dmp

Download

memory/2744-20-0x0000000000400000-0x0000000000422000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads