9b16a768a855dac850fcc3420dd0e13a5508f1c94f408ccdd13820ee914a33fc

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.exe
Size 370KB
Sample240229-1mxt8adh45
SHA256 9638581a59653c0d6f01110be90cfaf13b15ab91b3839ee9d46dce33f26e6a2b
MD5 633b2db9da9af8ce7f6c14acbd24770a
SHA1 7c6d4fc0cddb0213fc98421167f75e5d7afe27fe
SHA512 fac63132db6d52d55c10618dac00f3b4ffe7cc1ddc5284dd90da5e24f447366273aea7712590ab36a2f243535e7c095c4b29bef9f6ba54db4b3993ee55a52172
SSDEEP 3072:zXjoutudpVpg4fq0SjJpyHwwwkrqxGrDgaghZuRaaaPaAtzVSR+5MCG:zXjoSEVC4fq0QWBrrDz3WtzVSA5MC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	run.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
116	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3236-0-0x0000000000400000-0x00000000004BF000-memory.dmp	upx
behavioral4/memory/3236-10-0x0000000000400000-0x00000000004BF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 116	3236	run.exe	87
PID 3236 wrote to memory of 116	3236	run.exe	87
PID 3236 wrote to memory of 116	3236	run.exe	87
PID 116 wrote to memory of 3936	116	b2e.exe	88
PID 116 wrote to memory of 3936	116	b2e.exe	88
PID 116 wrote to memory of 3936	116	b2e.exe	88
PID 116 wrote to memory of 4712	116	b2e.exe	92
PID 116 wrote to memory of 4712	116	b2e.exe	92
PID 116 wrote to memory of 4712	116	b2e.exe	92

C:\Users\Admin\AppData\Local\Temp\run.exe
"C:\Users\Admin\AppData\Local\Temp\run.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\B14E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\B14E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B14E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\run.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B3FE.tmp\batfile.bat" "
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\B14E.tmp\b2e.exe
Size 8KB
SHA256 82b620227e2ff4eecdc396367ef3cd090db387d5fa9c28be98296892acbe0952
MD5 b59836f8bce4b7a9c5c44bd3d77bbc05
SHA1 deef3c038817d8af51ebae1c9b547bdeafe90500
SHA512 ba329fecfd4367fdc26b9daa3974e62d27b4763d850f182246ad2f27f8dcb445ec803b576d617d93881d774f2b19a437fef0909c8a637ec9fc2b3380113095d6
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcf:3R5Fhp8cdwpHR3AkPLiM79mLU2Pcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\B3FE.tmp\batfile.bat
Size 158B
SHA256 52ca6a8fe69ab59ca99b72500f5a9baadbe277ca0dea6dd8462acb322678a146
MD5 2ebd35710cdf46a6bfc1b7a9a573e991
SHA1 c52403395a0b51b50cd550e97d8cc260605bc873
SHA512 d2907d3fe5c3c44f8fb08e233671a9cf268f647e9cd7780c46b3db7afe74b5c59a410ac4993dd5e5a928b6dc5e95d31e6bebc34e1bf9746b6dab6283d798ea8f
MD5 SHA1 SHA512

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 ab6f60a828136a647076be0e988ec6c3804afcee865742c2a4c5cde15365591c
MD5 74f1b8c1ae1d067172f64ddd59d48bf9
SHA1 d4c0f20a8e220e205acae3acf47ce02e8a47a126
SHA512 48694bf6b92563cb212a9216f7e00f666ab2c2e5b143bc90db2ef497dac69fba0d18cccfbffe25ff0c9b322f5eed675c35a6f2bebb638ce9d2078e596e8dd0c3
MD5 SHA1 SHA512

Submit Download

memory/116-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/116-18-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3236-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3236-10-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads