f23044e2fd0574d7ec3d9e4674f916e0345088fa0d4ba7987d39284e3b858454

Analysis

max time kernel
87s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

17.7MB
MD5

fdcc95bf3dd57479491d8e94fa38e90d
SHA1

3003ba25278bf2a20c1cd05283615308ea25b1ce
SHA256

f23044e2fd0574d7ec3d9e4674f916e0345088fa0d4ba7987d39284e3b858454
SHA512

4171e117c895f7af7a9f9d42c3c0fde2694a6b0f0109d81ba3539e5a2b77cfa7c5c376a225fe9e080a907422b719ad043523f76ae4101e16c9642136b3ab7e0d
SSDEEP

393216:81Bww1GGftRFb2KCgqD6cmLUIf4qZPFZ4duys:84IftRl2/gqD6uqFFCd8

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	tmp.exe

Loads dropped DLL 7 IoCs

pid	Process
2764	tmp.exe
2764	tmp.exe
2764	tmp.exe
2764	tmp.exe
2764	tmp.exe
2764	tmp.exe
2764	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	tmp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2880	2764	tmp.exe	85
PID 2764 wrote to memory of 2880	2764	tmp.exe	85
PID 2764 wrote to memory of 2880	2764	tmp.exe	85
PID 2880 wrote to memory of 3808	2880	cmd.exe	87
PID 2880 wrote to memory of 3808	2880	cmd.exe	87
PID 2880 wrote to memory of 3808	2880	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"17B18BD9\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-ar-mutaz\",\"install_trackversion\":\"2.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=TQ-BdekiTo671_UiBfGprA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\curl.exe
    curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"au-Windows\",\"user_id\":\"17B18BD9\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"install_productversion\":\"Official-ar-mutaz\",\"install_trackversion\":\"2.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-G1ZWRJY8K8&api_secret=TQ-BdekiTo671_UiBfGprA"
    3⤵
    PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\CheckProVs.dll

Filesize
7KB

MD5
62e85098ce43cb3d5c422e49390b7071

SHA1
df6722f155ce2a1379eff53a9ad1611ddecbb3bf

SHA256
ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2

SHA512
dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\GoogleTracingLib.dll

Filesize
36KB

MD5
d8fca35ff95fe00a7174177181f8bd13

SHA1
fbafea4d2790dd2c0d022dfb08ded91de7f5265e

SHA256
ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c

SHA512
eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\msvcp100.dll

Filesize
593KB

MD5
d029339c0f59cf662094eddf8c42b2b5

SHA1
a0b6de44255ce7bfade9a5b559dd04f2972bfdc8

SHA256
934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c

SHA512
021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\msvcr100.dll

Filesize
809KB

MD5
366fd6f3a451351b5df2d7c4ecf4c73a

SHA1
50db750522b9630757f91b53df377fd4ed4e2d66

SHA256
ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5

SHA512
2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\nsDui.dll

Filesize
5.4MB

MD5
a6a9ccd1c7ae96e3abc1750f0eaacef9

SHA1
40abfc17a62c6e6ae81b42267c80b5068696459d

SHA256
eec20aed9b43aed85da95799bef7d5c316b093e8b5e45656f145d222436c45e6

SHA512
7c972f2b6c8f42964abd82c0db4e2adf59e5ee381f74b747f7bf08b1e430e7489852d9e921798bb8a6986a993353fee0d8e04bc142b9f4ca32d3cd51ea3e30a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse4595.tmp\nsDui.dll

Filesize
5.8MB

MD5
cc7a39474889f5c2f7a356ffdc379e84

SHA1
70ed8bb13800c0caa9428ad27da34dbf817b7102

SHA256
ce70c1e7ebd8d0faf8691a9d585c8947528d390bf1d847dff79f5aae5c0e0f09

SHA512
3ec15aa68d0c45c8a22a5b9366a210ae8031ee7b7543c66b3226c716cc8317a898bae0cb9ac01e162a2db6979cd7fc63fdc3008e8a00819f84f7a6a2e75074df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads