2d007624183ee6ba7e6e143b8d94b93468c668aadef2e103be11a5d76c15e072

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b32ada6bd5721933bf0be3b69e7addab.exe
Size 343KB
Sample240306-c2jzxaab78
SHA256 2d007624183ee6ba7e6e143b8d94b93468c668aadef2e103be11a5d76c15e072
MD5 b32ada6bd5721933bf0be3b69e7addab
SHA1 58cb311c0318ded57d525dc4f0a2a3fcb3f18897
SHA512 37c801b52e0a421f344840960d25b9b0ad1cbb0d7fcbf54fb6198a8a7c369df0cef2937985b58016d18ec602a406e3804d37aef07253f1fe1b6dcab250cfb056
SSDEEP 6144:md93ZBZMbqYgomHmSTJAj7tikPVKDdpT9c1xQIXEZfruaiPf8cJLCPtgBIJ4vWPY:mr3ZBIRSkQhexQyEtrupf8Q+PQIWvX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	b32ada6bd5721933bf0be3b69e7addab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	pig.exe

Executes dropped EXE 2 IoCs

pid	Process
3152	pig.exe
4728	19.exe

Loads dropped DLL 6 IoCs

pid	Process
4728	19.exe
4728	19.exe
3152	pig.exe
3152	pig.exe
4868	b32ada6bd5721933bf0be3b69e7addab.exe
4868	b32ada6bd5721933bf0be3b69e7addab.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HELP\F3C74E3FA248.dll	19.exe
File opened for modification	C:\Windows\HELP\F3C74E3FA248.dll	19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ = "C:\\Windows\\HELP\\F3C74E3FA248.dll"	19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ThreadingModel = "Apartment"	19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}	19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\ = "SSUUDL"	19.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32	19.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4728	19.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3152	4868	b32ada6bd5721933bf0be3b69e7addab.exe	89
PID 4868 wrote to memory of 3152	4868	b32ada6bd5721933bf0be3b69e7addab.exe	89
PID 4868 wrote to memory of 3152	4868	b32ada6bd5721933bf0be3b69e7addab.exe	89
PID 3152 wrote to memory of 4728	3152	pig.exe	90
PID 3152 wrote to memory of 4728	3152	pig.exe	90
PID 3152 wrote to memory of 4728	3152	pig.exe	90
PID 4728 wrote to memory of 3864	4728	19.exe	91
PID 4728 wrote to memory of 3864	4728	19.exe	91
PID 4728 wrote to memory of 3864	4728	19.exe	91
PID 4728 wrote to memory of 2764	4728	19.exe	102
PID 4728 wrote to memory of 2764	4728	19.exe	102
PID 4728 wrote to memory of 2764	4728	19.exe	102

C:\Users\Admin\AppData\Local\Temp\b32ada6bd5721933bf0be3b69e7addab.exe
"C:\Users\Admin\AppData\Local\Temp\b32ada6bd5721933bf0be3b69e7addab.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\pig.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\pig.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\19.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\19.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2.bat
      4⤵
      PID:3864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2.bat
      4⤵
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

19.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\19.exe
Size 121KB
SHA256 a5ce545e50d5c5b723d805b0bfde6e60cd86fde295117699baf005a1796e3992
MD5 595e11860894a472662286104bb11939
SHA1 59e87db48b6f1098f513869b156b8bdaf0cf65f6
SHA512 db688bbaa64d1848aeb67a04f869ffc5bf48352d8596ad056663e60ad96b3aaf9c2a7d3f03b9b4c735d53941bf0e310982502f4205541ad8fbdc6d75f9761870
SSDEEP 3072:I/U7oF+pIHiYzzy25OrWFXy6uXvu0C4RtFLR+zpp:I/y+HiEGcUanuX20CEF6
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.bat
Size 62B
SHA256 568d76aaca5530b14c081eed43069e9267fa0994c0c8a374f9ec687097d13131
MD5 6f2aee92a52f2ff14738a09d4a31fecc
SHA1 3eee73faa5d506650cede961470281e8c8dae02c
SHA512 5e56dd52c7d60f6f6654f84e79dc90c57c86296f34e34c4d6631333ac2c51bcab884ed0c61795659f66662a00c580bdce187417fb39e749571e377bcea9be2bb
MD5 SHA1 SHA512

Submit Download

2.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.bat
Size 63B
SHA256 9f8450dd17d47775a8782e983417a596e7f2f247d574570634026b8ad9217dc1
MD5 827ca4854cec262f79ead5d1e53845be
SHA1 f5d57bb41d9f198f27946a16a148e1a560e3206c
SHA512 5256d20798c596bf84c98d22653293b079716fd8a2e186a60b8bb45fe9125ea22cea3fec7170a2dfaf654a2f2dad8b835926c480b21d1f81a28e70ffd7b4d259
MD5 SHA1 SHA512

Submit Download

pig.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pig.exe
Size 158KB
SHA256 1bd4e72fd6c86b9415b1152d0a7cd760a25e098321645f4cad16d1b4b7a56b9e
MD5 aa90359e0ef65752db33466a8fd70742
SHA1 2373c0221dbdf630183494aef714d7798932611f
SHA512 9533a6d38abfc7dfae093318410fc9ceadb552aef5886e34fac0c2cbca2a1b5fd6e415fe49607b67b6bf592d95a7dd987a8945a6c7549ea4920916bc96ee57dd
SSDEEP 3072:8d9xR3G2BZMbBLBaYw0coLujNHm8Hc1hj5DOouzkPFkh+XEB69Q:8d93ZBZMbqYgomHmXXFB9kh+XEGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F3C74E3FA248.dll

Path C:\Windows\Help\F3C74E3FA248.dll
Size 109KB
SHA256 8b5e4e299f6db99955b2997949204b8ffc4a10268bd52f2c04815113b6679a92
MD5 554e92394fc3f49a607ce0c799adacdf
SHA1 ef787677fea898ffdb90bed75c6f8f0bda1c5124
SHA512 fe1d3320add454f8ffc9d00fc4cce5851866387fed9e9a0d5b18acda7eebe9db3ab23734c3c2b7f6af3f275de3112146d7273c6abdc4697c2c276ba808df8a37
SSDEEP 3072:7ZGQxsEt3Xidh1T84aCWnuxv5jMPovkZyxzeo:7ZGQWo3whJ8Bu3jMPJZGSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3152-20-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3152-40-0x0000000002670000-0x00000000026BA000-memory.dmp

Download

memory/4728-17-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4728-31-0x0000000002050000-0x000000000209A000-memory.dmp

Download

memory/4728-34-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4728-32-0x0000000002050000-0x000000000209A000-memory.dmp

Download

memory/4728-33-0x0000000002050000-0x000000000209A000-memory.dmp

Download

memory/4728-13-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4728-35-0x0000000002050000-0x000000000209A000-memory.dmp

Download

memory/4728-16-0x00000000001D0000-0x00000000001D2000-memory.dmp

Download

memory/4728-43-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4868-19-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4868-44-0x0000000002A30000-0x0000000002A7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads