d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

General

Target

b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Size

1011KB
MD5

b9ec5d1263ce730e0be1e8cf64c58cf4
SHA1

d30aab11a419fc105a15b9505dbeaa931d19c735
SHA256

d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046
SHA512

60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0
SSDEEP

24576:d3BPQLBt4p3UAh2vFjr0AFnOC6R/TJiUr2Fu+8Q:kQktvFjrX+Ldk

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	b9ec5d1263ce730e0be1e8cf64c58cf4.exe

Executes dropped EXE 1 IoCs

pid	Process
2504	06152620.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\06152620 = "C:\\ProgramData\\06152620\\06152620.exe"	b9ec5d1263ce730e0be1e8cf64c58cf4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\06152620 = "C:\\PROGRA~3\\06152620\\06152620.exe"	06152620.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2504	06152620.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe
2504	06152620.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 208	4836	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	90
PID 4836 wrote to memory of 208	4836	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	90
PID 4836 wrote to memory of 208	4836	b9ec5d1263ce730e0be1e8cf64c58cf4.exe	90
PID 208 wrote to memory of 4564	208	cmd.exe	93
PID 208 wrote to memory of 4564	208	cmd.exe	93
PID 208 wrote to memory of 4564	208	cmd.exe	93
PID 4564 wrote to memory of 2504	4564	cmd.exe	95
PID 4564 wrote to memory of 2504	4564	cmd.exe	95
PID 4564 wrote to memory of 2504	4564	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe
"C:\Users\Admin\AppData\Local\Temp\b9ec5d1263ce730e0be1e8cf64c58cf4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\06152620\06152620.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\06152620\06152620.exe /inst
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\PROGRA~3\06152620\06152620.exe
      C:\PROGRA~3\06152620\06152620.exe /inst
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\06152620\06152620.exe

Filesize
1011KB

MD5
b9ec5d1263ce730e0be1e8cf64c58cf4

SHA1
d30aab11a419fc105a15b9505dbeaa931d19c735

SHA256
d481aeca84f16a3284d4de9af3625eb21024f48298538e03b3ec0921f2831046

SHA512
60782d9b3a69403c909e851b353ba93a737a0ea9a17c0b96a472c262a31ef20a37fe5437906396674a8dba0597dac64575d82b03d9361a25714fc4aaff9636b0

Download Submit
C:\ProgramData\06152620\06152620.bat

Filesize
233B

MD5
aebeab0f327a309852f8903c8a4314fe

SHA1
9f758b15880dd35b564e68e4b1ef976491ba1d66

SHA256
f76c4ed4a6b0446184e1ea35a9b12f8fa3337961ea0f9ef2ed1a50edf5a776d9

SHA512
d8e650d5ed68fd733569010e99214261a5d3d50f7772df0de443b6871e5d156597443fc75ce11c07a796a2ffcaadaff0eeca32c110852ae26e2775b3e18548d6

Download Submit
C:\ProgramData\06152620\06152620.exe

Filesize
974KB

MD5
f948063dcf2a19e8f243d1045810909a

SHA1
3b5c329625490f059e6390a29bd31f4abc0d741f

SHA256
3bb4a4bd20aebfa22c4cf85c71f4c6fbc5b1642ed856165dead7d715be8a0a02

SHA512
414d83ec7a9251eddd8f6ba965b9e646734a1e57ff6304fcd6612cc6f5ee96b7485c0341b6e49c945df971c4852a4c53b4e476e3bb0811b85ce9955e2f5ff932

Download Submit
memory/2504-21-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-23-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-33-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-32-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-31-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-15-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/2504-16-0x0000000000660000-0x0000000000662000-memory.dmp

Filesize
8KB

Download
memory/2504-17-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/2504-20-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-30-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-22-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/2504-28-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-24-0x0000000000660000-0x0000000000662000-memory.dmp

Filesize
8KB

Download
memory/2504-25-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/2504-26-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2504-27-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4836-9-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4836-1-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4836-2-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/4836-3-0x0000000000930000-0x0000000000932000-memory.dmp

Filesize
8KB

Download
memory/4836-4-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads