Overview

overview

10

Static

static

10

6ed2947e65...b2.exe

windows7-x64

4

6ed2947e65...b2.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 01:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2.exe
  • Size 25.9MB
  • Sample240229-bq6tvsaa8v
  • SHA256 6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2
  • MD5 SHA1 SHA512 SSDEEP
Score
5/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • NTFS ADS 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2.exe
    "C:\Users\Admin\AppData\Local\Temp\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Registers COM server for autorun
    • Modifies registry class
    • NTFS ADS
    PID:2428

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HiveCloudBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\HiveCloudBridge.dll
        • Size 368KB
        • SHA256 31d2cbd81306cf30ee2aff1d939cbf93db0e1ff910ec45a6325d1d5d0c2560a7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\Microsoft.Win32.Primitives.dll
        • Size 8KB
        • SHA256 7c7e831e99128f389b4a69e0158f2310dd160bed5c8926f4678c6740f811fb3e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Collections.Concurrent.dll
        • Size 48KB
        • SHA256 ab83740f1c4e945763b70482e22ece340d970fbe906371f76b14468cdc53dc99
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Collections.dll
        • Size 27KB
        • SHA256 0ba02f437981a8c31024402818bb734da58d36dc60897105a954cc9ec18edfe5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.ComponentModel.Primitives.dll
        • Size 19KB
        • SHA256 b77e06b1972a884ff141e67d255b800d431db5e998d1683ef846427e2167e0d9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.ComponentModel.dll
        • Size 5KB
        • SHA256 4d756ab3288b3678ed7810bb61151dbe91c5c7a014c28061e5475d31b1fa6d56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.IO.FileSystem.AccessControl.dll
        • Size 16KB
        • SHA256 93117044cab09dde99e90a15731104b260514238a66043c4c59c42473dea4f4c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.DriveInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.IO.FileSystem.DriveInfo.dll
        • Size 16KB
        • SHA256 0cadea0d45b51d66fb8d4132fa794892a8e8ab1f869cf56f70c59d8353153a75
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.Watcher.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.IO.FileSystem.Watcher.dll
        • Size 26KB
        • SHA256 6e317fcf84748809ee9e2cd73875d1478b0a9805e2d718527374d9387806b34b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.Pipes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.IO.Pipes.dll
        • Size 42KB
        • SHA256 4667505a379a2ac687538c34448aa5a0e431ea2468cc3dff6c17264f61ce987d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Linq.Expressions.dll
        • Size 490KB
        • SHA256 f4db975e16215496869c85706690e61b1b19686d2d0f9bf81451372bb4b56fa5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Linq.dll
        • Size 72KB
        • SHA256 a89c423cd310d52c6e7eb0c7bcf5ee70f1957580e85bac30460f9508ddf457dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Http.dll
        • Size 555KB
        • SHA256 247cc65196b01bb20fd4a1ac0e89f08c5c920c470137988094f59c4815f8361d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Mail.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Mail.dll
        • Size 145KB
        • SHA256 d354a0b17d6049becdb9b1ad24e64d65f46b5347d021257e414061c1354c522f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.NameResolution.dll
        • Size 31KB
        • SHA256 8e490b0ecac92255a429a83ab80925b94e7e949407e12324983b16206280bd83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NetworkInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.NetworkInformation.dll
        • Size 33KB
        • SHA256 fa9cbb4b5d28ca67be566c440e04e8e74b5b30354571342c409f185555867f35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Primitives.dll
        • Size 67KB
        • SHA256 53f14d8f29bf48a248a962c6bf4a67da001a2b6980530984f8d686559418bd43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Quic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Quic.dll
        • Size 92KB
        • SHA256 e507d61ad243dd18655ac4faa40452274f9678293d632b595b3d52f7388946d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Security.dll
        • Size 173KB
        • SHA256 98c3342f9889133b276ece666a75124fc563a23548a9a895aeec1a59ad447719
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Sockets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Net.Sockets.dll
        • Size 109KB
        • SHA256 fd0f75803f785bdac13ef6a4d4e8886e6df3318688f03f7a09141bab1b655649
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.ObjectModel.dll
        • Size 29KB
        • SHA256 b84c57bcf31d6799d76f4586ecbdc6daa6fbca2623ae0218673d2c402749d327
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Private.CoreLib.dll
        • Size 2.5MB
        • SHA256 f669c0ddec7820df2e2ea1146c2980e8ab61af37adde24a0393cf9ca3ba1a1e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Private.Uri.dll
        • Size 75KB
        • SHA256 b3b663db707fe84ee1e5fe32aa829a0109cec89d5e8f10c466d89b4bf4dce973
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Runtime.CompilerServices.Unsafe.dll
        • Size 5KB
        • SHA256 9ba1c2720f9db6b78940e649f94d420894c72f0602249c068ea01b9ef05ca795
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.RuntimeInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Runtime.InteropServices.RuntimeInformation.dll
        • Size 10KB
        • SHA256 483a07dbc80d8f68073927e28ebec0fcf7b0ba3821510db6efbd5c22fb8e2ceb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Runtime.InteropServices.dll
        • Size 7KB
        • SHA256 3548c7fe1edac1f84e9244c45069a6b091ba6b696df7fc9674434c435c567280
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Security.Claims.dll
        • Size 15KB
        • SHA256 679ecd7b35682eec5c05ea71d2e429486ad884c457f42c677fff7d4e0ad408e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Security.Cryptography.Algorithms.dll
        • Size 98KB
        • SHA256 8af7e08db617224dfd336a6ecd3bb1398241dc0cf1b585207b7981cab77f4d3e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Security.Cryptography.Primitives.dll
        • Size 36KB
        • SHA256 b074754c6cfdc0126d3166c284d63a6d387d1eb84fd8d0e6f1a0d158398cf6f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Security.Cryptography.X509Certificates.dll
        • Size 136KB
        • SHA256 fd2ff48fd3de776e7719725a6be7d8ca96bbdd76e81cce983154265fa831e248
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Security.Principal.Windows.dll
        • Size 50KB
        • SHA256 ec398b0127492b862742addac68dec89a37824ea69c0c9c3207cdde63a99183d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\6ed2947e650e5ad69147353915a0e8fd5852b4c0ab19e595d22ef85b3f20bab2\i5uw0Wlep3i3Zbp5pkOhnuocgN6Z0Hw=\System.Threading.dll
        • Size 17KB
        • SHA256 284dae0176284843153de407eb86caa69e6de4d5d7705c6ffa170117fde20298
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2428-165-0x00007FF616DE0000-0x00007FF617751000-memory.dmp
        Download

        memory/2428-341-0x00007FF616DE0000-0x00007FF617751000-memory.dmp
        Download