047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331

General

Target

047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe
Size

277KB
MD5

3a76e8af8b521e188ab772164a06a72d
SHA1

9ffe217b67b9ecc088b52a76a50d64dc358b2d22
SHA256

047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331
SHA512

37d695dbe95d2897b359c98581e13fe4ac342eca59c3ecddc0b40799038a01487a027bc28ab84279e8e3fd73716cf61197e7f251fb04a09d8601d1aefcbdfab7
SSDEEP

6144:VLaARS0LBZmht0eQMlvNjwD4CAVvmEYX303EHweC78DjVsxv:VmAU0LrK6Mlvp6MUn0Des8DxQv

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral2/memory/3908-0-0x0000000000400000-0x0000000000489000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3908-29-0x0000000000400000-0x0000000000489000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3908-34-0x0000000000400000-0x0000000000489000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe

Executes dropped EXE 1 IoCs

pid	Process
692	ins9482.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	ins9482.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ins9482.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	ins9482.exe
File created	C:\Windows\assembly\Desktop.ini	ins9482.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ins9482.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
692	ins9482.exe
692	ins9482.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	ins9482.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
692	ins9482.exe
692	ins9482.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 692	3908	047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe	88
PID 3908 wrote to memory of 692	3908	047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe	88

C:\Users\Admin\AppData\Local\Temp\047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe
"C:\Users\Admin\AppData\Local\Temp\047627503a9965c42176826cf1814ad2ce4025dda3b6a7f86dcba7865e6b0331.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\n9482\ins9482.exe
  "C:\Users\Admin\AppData\Local\Temp\n9482\ins9482.exe" ins.exe /e8021357 /u51938065-e47c-4b97-bfda-2a105bc06f2f
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n9482\ins9482.exe

Filesize
265KB

MD5
4c24a9e76a700931ae23e212519593c3

SHA1
d738435c7d5d98223462e6b4dd97e1081f911e97

SHA256
75912abe46cabda79f285ba2b0d70c8aa31eae564886d2f483f3e325379b67fb

SHA512
d48038bdd5e06761c45b711cf7dff1c5b6e56e5cbc230041fb16e1f3418235809008ea3545375e02b48b0cca1857348ea23fd4fd35165e72df9a9956b225f12f

Download Submit
memory/692-23-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-24-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-13-0x00007FFBAD8A0000-0x00007FFBAE241000-memory.dmp

Filesize
9.6MB

Download
memory/692-14-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-15-0x000000001B1C0000-0x000000001B1CA000-memory.dmp

Filesize
40KB

Download
memory/692-18-0x000000001B9C0000-0x000000001BE8E000-memory.dmp

Filesize
4.8MB

Download
memory/692-19-0x000000001BF30000-0x000000001BFCC000-memory.dmp

Filesize
624KB

Download
memory/692-20-0x000000001B1A0000-0x000000001B1A8000-memory.dmp

Filesize
32KB

Download
memory/692-21-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-33-0x00007FFBAD8A0000-0x00007FFBAE241000-memory.dmp

Filesize
9.6MB

Download
memory/692-12-0x00007FFBAD8A0000-0x00007FFBAE241000-memory.dmp

Filesize
9.6MB

Download
memory/692-25-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-22-0x0000000000B60000-0x0000000000B70000-memory.dmp

Filesize
64KB

Download
memory/692-26-0x000000001D320000-0x000000001D382000-memory.dmp

Filesize
392KB

Download
memory/692-27-0x000000001FA50000-0x000000001FB8C000-memory.dmp

Filesize
1.2MB

Download
memory/692-28-0x00000000200A0000-0x00000000205AE000-memory.dmp

Filesize
5.1MB

Download
memory/692-31-0x00007FFBAD8A0000-0x00007FFBAE241000-memory.dmp

Filesize
9.6MB

Download
memory/692-30-0x00000000205B0000-0x00000000206B0000-memory.dmp

Filesize
1024KB

Download
memory/3908-29-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3908-0-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3908-34-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download

Analysis

Sharing