cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
Size

39KB
MD5

2af63dd437a1253d6d52e23c757b8791
SHA1

c2ab1be507cd2575456fbd761cfa65f4d283d6d8
SHA256

cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11
SHA512

fbc41beb0a1af47af1c78206ee12451f2be6b7d3975ff943e2a1f7cae3aa019e2cf56417ca866ae5eea713410f769c57336b27c64b3788363d2d688f8c581059
SSDEEP

384:0K5kypvP/fm5iySkMP+OijkOj0tOcOYWO6O9Ock8szTDhCU/xLI3BZnthyWoPxIK:0KntXyDOo26TDhCU/xLQBZnK5Z7Jag

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	saloon.exe

Executes dropped EXE 1 IoCs

pid	Process
1336	saloon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1336	4612	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	89
PID 4612 wrote to memory of 1336	4612	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	89
PID 4612 wrote to memory of 1336	4612	cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe	89

C:\Users\Admin\AppData\Local\Temp\cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe
"C:\Users\Admin\AppData\Local\Temp\cf79daaa640a2276784492a9e99c7ca40f4bed9c42e917185a7eb155c414af11.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\saloon.exe
  "C:\Users\Admin\AppData\Local\Temp\saloon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\agdsly.exe

Filesize
21KB

MD5
1df31f79ba551a38d99d6c49bd2232ec

SHA1
9da094ea999087cc44de92dfd693bf6d125efaf0

SHA256
9fc94256a583ed874e2c2a1b06fad9fc1d56e9764dff3679465b00a92f0235ab

SHA512
34da998090fba024fbee67d2ebfbea28c2d29cb0c09c336153ba9f1739435b01d6968c07bcf5efe90bbca5419990343c17a86576815adfc1012af8694b3f6f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\saloon.exe

Filesize
40KB

MD5
b2bff5c437c16afd2458e9da1a4d5676

SHA1
3f54787e8cb617e8f0d0bc37739c44d547fe2bc2

SHA256
226977344f6e1547d23487b946b68befe7ee02f9b4e91979acd58f77875137ca

SHA512
b4e400ed7ebfe0640ef888ec0b6ffbd89f9fa4d3e8571a347d419a829e504963ace699712bad69a849f01670c86a3c5ea311a7c67cb75118399d8539b8812fb4

Download Submit
memory/1336-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4612-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download