Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/03/2024, 01:59
Behavioral task
behavioral1
Sample
f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe
- Size 369KB
- Sample240310-cet7cshb69
- SHA256 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d
- MD5 64c0a6d133b98362d7bd31475b6193be
- SHA1 85cdb341d3d67c47a599ff53a5d9f1734d8660b8
- SHA512 180bd69601e2b83b303df4eaccdfc2564df7343181951afb363773902ff0b8b65f23cf409325af9299d197b3efc0d6e236e32e8b8000d10c092a5eb76bcd12d8
- SSDEEP 6144:CuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pW:CzGL2C2aZ2/F1WHHUaveOHjTy
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation mudua.exe - Executes dropped EXE 2 IoCs
pid Process 4860 mudua.exe 2220 loezc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe 2220 loezc.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4860 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 92 PID 5084 wrote to memory of 4860 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 92 PID 5084 wrote to memory of 4860 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 92 PID 5084 wrote to memory of 4992 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 93 PID 5084 wrote to memory of 4992 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 93 PID 5084 wrote to memory of 4992 5084 f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe 93 PID 4860 wrote to memory of 2220 4860 mudua.exe 107 PID 4860 wrote to memory of 2220 4860 mudua.exe 107 PID 4860 wrote to memory of 2220 4860 mudua.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe"C:\Users\Admin\AppData\Local\Temp\f41db68667d99472c794f60db29bc1d61bc8ee470aec5d273864588930be190d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\mudua.exe"C:\Users\Admin\AppData\Local\Temp\mudua.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\loezc.exe"C:\Users\Admin\AppData\Local\Temp\loezc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵PID:4992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 340B
- SHA256 08279034be91fc9f79692d0e1b085b17da59ab0fb3dc0fb2a02c9c0a1526b4a7
- MD5 c33671286745d496ee8208750cc116c3
- SHA1 9776874ef4b158b2e5d2cbf2216ce98f8f47bb92
- SHA512 c383a612dbd3e7c2062fe428bb35a3303c54b6b8ade7a07535916a8d4b025faf07ea3fafa0e02813915196c7a32e03a5c507d00f65d3408bc45b2d22b0d578af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 da6afb444746d7ac425dfebdc89e2c2fe44e89434eef993eb36ef353ea48b231
- MD5 ecf96d140050e4558ad3af0c65202ae8
- SHA1 8d6819d56ebd2447a104f8f8273e993af905dac8
- SHA512 15fd824ee454787b97a1a75f0e8d6f1d3c6948938a780cbbe3d4d7707f194fd6dffbdb707d4d69feb0e95234d707a4e16334b4c96cbe449cce975fd13cb78d99
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\loezc.exe
- Size 303KB
- SHA256 a2b491da0f80474437c8b75c1bc65a5596589f6aad35bce7efeec083cf236714
- MD5 381958e557478cf9da0b47d89679c465
- SHA1 58f2135e16729ad0c3f722ff743604746ae7b864
- SHA512 8e7e05842a164c0b71e6136c31bb473b633b7a6c20e45f19df6a01539df81df3eae463636c987aaf591f0caed1770d34d300a03257479f57f4f30fd76307f6f7
- SSDEEP 6144:ddI/RDUXW62fs1FbIbrvBcVPH0T5J5ZtmOZpw:XI/RDUm/S5IH57/o5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\mudua.exe
- Size 369KB
- SHA256 2303fdd96ef7741ad3c27ea00cba987a38740f4d096725389d11c63ea4844d26
- MD5 a87047cadeb63edd74e79a2a792c390f
- SHA1 7e2d5fa5811153f8da7463802f1a809ad18ba4ef
- SHA512 8647a52d76720c1cac667b92ed954bacd4628aa0632eb22f315e5352820fb5e7a050557da141719f523c0e11a26717c2ba8f5faae61a433acb0e18cd3a7f9205
- SSDEEP 6144:CuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pb:CzGL2C2aZ2/F1WHHUaveOHjTX
- MD5 SHA1 SHA512 SSDEEP