2bdddb09bd97485a8662ccf069a3c10963559f12c23045fa3dd28bc0c56851e4

General

Target

e0108c567b623ef4804638d892ab2fa3.exe
Size

70KB
MD5

e0108c567b623ef4804638d892ab2fa3
SHA1

4e9b33976d8f25eb941883476a0da50fe7726faa
SHA256

2bdddb09bd97485a8662ccf069a3c10963559f12c23045fa3dd28bc0c56851e4
SHA512

85f79109e7f62f9e5618fc42d5ed79aa05ee4cca943048dd4b093cf30709fd76f79e791172890f891ab5e3974abbe26ffd58f3c91478ae7f0c09d83a03bb6e04
SSDEEP

1536:g3Tvc4o6pYScxHmkq6UwmAYzj/8sJQ26bk5NV3h4TFu:go4Y7bdmAWj/JGbl

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	e0108c567b623ef4804638d892ab2fa3.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "kdqgc.exe"	e0108c567b623ef4804638d892ab2fa3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kdqgc.exe	e0108c567b623ef4804638d892ab2fa3.exe
File opened for modification	C:\Windows\SysWOW64\kdqgc.exe	e0108c567b623ef4804638d892ab2fa3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 1376	3212	e0108c567b623ef4804638d892ab2fa3.exe	99

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo	e0108c567b623ef4804638d892ab2fa3.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International	e0108c567b623ef4804638d892ab2fa3.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3212	e0108c567b623ef4804638d892ab2fa3.exe
3212	e0108c567b623ef4804638d892ab2fa3.exe
3212	e0108c567b623ef4804638d892ab2fa3.exe
3212	e0108c567b623ef4804638d892ab2fa3.exe
3212	e0108c567b623ef4804638d892ab2fa3.exe
3212	e0108c567b623ef4804638d892ab2fa3.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeSecurityPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeTakeOwnershipPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeLoadDriverPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeSystemProfilePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeSystemtimePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeProfSingleProcessPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeIncBasePriorityPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeCreatePagefilePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeBackupPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeRestorePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeShutdownPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeDebugPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeSystemEnvironmentPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeChangeNotifyPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeRemoteShutdownPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeUndockPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeManageVolumePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeImpersonatePrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: SeCreateGlobalPrivilege	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: 33	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: 34	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: 35	3212	e0108c567b623ef4804638d892ab2fa3.exe
Token: 36	3212	e0108c567b623ef4804638d892ab2fa3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3540	3212	e0108c567b623ef4804638d892ab2fa3.exe	98
PID 3212 wrote to memory of 3540	3212	e0108c567b623ef4804638d892ab2fa3.exe	98
PID 3212 wrote to memory of 1376	3212	e0108c567b623ef4804638d892ab2fa3.exe	99
PID 3212 wrote to memory of 1376	3212	e0108c567b623ef4804638d892ab2fa3.exe	99

C:\Users\Admin\AppData\Local\Temp\e0108c567b623ef4804638d892ab2fa3.exe
"C:\Users\Admin\AppData\Local\Temp\e0108c567b623ef4804638d892ab2fa3.exe"
1⤵
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\bfsvc.exe
  C:\Windows\bfsvc.exe
  2⤵
  PID:3540
- C:\Windows\bfsvc.exe
  C:\Windows\bfsvc.exe
  2⤵
  PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3212-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3212-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3212-2-0x000000006B800000-0x000000006B8F0000-memory.dmp

Filesize
960KB

Download
memory/3212-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads