Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 14:56
General
- Target df7022a137894b7bf6a10323cee99e69.exe
- Size 3.2MB
- Sample240326-sbfgsscf64
- SHA256 eea7285f1d77894b0145e24f959176bef941860a4633d270ac03baac41ab6ff9
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df7022a137894b7bf6a10323cee99e69.exe"C:\Users\Admin\AppData\Local\Temp\df7022a137894b7bf6a10323cee99e69.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Mercurial.exe"C:\Users\Admin\AppData\Roaming\Mercurial.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 11603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 15003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\multitool.bat" "2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1692 -ip 16921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1692 -ip 16921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Mercurial.exe
Mercurial.exe
Mercurial.exe
multitool.bat
memory/1692-38-0x00000000054E0000-0x0000000005510000-memory.dmp
memory/1692-33-0x0000000005300000-0x0000000005336000-memory.dmp
memory/1692-61-0x0000000071B80000-0x0000000072330000-memory.dmp
memory/1692-21-0x0000000000220000-0x000000000055A000-memory.dmp
memory/1692-22-0x0000000005560000-0x0000000005B04000-memory.dmp
memory/1692-23-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/1692-24-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-25-0x0000000004F60000-0x0000000004F6A000-memory.dmp
memory/1692-26-0x0000000004F70000-0x0000000004F8C000-memory.dmp
memory/1692-27-0x00000000051B0000-0x00000000051D0000-memory.dmp
memory/1692-28-0x00000000051E0000-0x0000000005200000-memory.dmp
memory/1692-29-0x0000000005220000-0x0000000005230000-memory.dmp
memory/1692-30-0x0000000005230000-0x0000000005244000-memory.dmp
memory/1692-31-0x0000000005240000-0x00000000052AE000-memory.dmp
memory/1692-32-0x00000000052C0000-0x00000000052DE000-memory.dmp
memory/1692-41-0x0000000071B80000-0x0000000072330000-memory.dmp
memory/1692-34-0x0000000005340000-0x000000000534E000-memory.dmp
memory/1692-35-0x0000000005360000-0x000000000536E000-memory.dmp
memory/1692-36-0x0000000005CD0000-0x0000000005E1A000-memory.dmp
memory/1692-37-0x0000000005E80000-0x0000000005F96000-memory.dmp
memory/1692-20-0x0000000071B80000-0x0000000072330000-memory.dmp
memory/1692-39-0x0000000008980000-0x0000000008988000-memory.dmp
memory/1692-60-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-40-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-56-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-43-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-44-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-45-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-46-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-47-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-48-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-49-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-50-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-51-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-52-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-53-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-54-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-55-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-42-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/1692-57-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-58-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/1692-59-0x0000000005BD0000-0x0000000005CD0000-memory.dmp
memory/4848-0-0x00000000749B0000-0x0000000074F61000-memory.dmp
memory/4848-1-0x00000000749B0000-0x0000000074F61000-memory.dmp
memory/4848-2-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/4848-18-0x00000000749B0000-0x0000000074F61000-memory.dmp