Analysis
-
max time kernel
90s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 18:36
Static task
static1
Behavioral task
behavioral1
Sample
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe
Resource
win10v2004-20231215-en
General
-
Target
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe
-
Size
135KB
-
MD5
f92a287fb47eefefe62eab8bbdb8a7a5
-
SHA1
e32ed380f20f10530cc3b13ed211a131cd46c3e8
-
SHA256
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57
-
SHA512
c6f46de69e9c3b8f955a80f2ad0dac2db22fc6e9fe6488fbd423c19fcc3685d0a7dbe12bc37447ecce9a1fef571822c67a418ce1ccf85e87cf7295a70256d46d
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKN:xPd4n/M+WLcilrpgGH/GwY87mVmIXd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe -
Executes dropped EXE 1 IoCs
Processes:
wn2ra4ohzdr.exepid process 1688 wn2ra4ohzdr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exewn2ra4ohzdr.exedescription pid process target process PID 5068 wrote to memory of 1688 5068 0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe wn2ra4ohzdr.exe PID 5068 wrote to memory of 1688 5068 0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe wn2ra4ohzdr.exe PID 5068 wrote to memory of 1688 5068 0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe wn2ra4ohzdr.exe PID 1688 wrote to memory of 5032 1688 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1688 wrote to memory of 5032 1688 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1688 wrote to memory of 5032 1688 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe"C:\Users\Admin\AppData\Local\Temp\0c7be5e596ea71f1d7e1f04e57265794d7fdba4a64e872883d5a2ef4cbe62c57.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exeFilesize
135KB
MD5369297390bcdd3a928aba5754138c56c
SHA1c9fd4b30beb37f55d3512992fd30e1456c3b014a
SHA25600079528c669aabab26087b3951cc0afb540ec204e278f77f2435806353e052d
SHA512ed1ab2629eecd3faea7c3d1c833c710deac5d3a20800494a63adf394bc81ee31bb875492e22b7a638032fbf0352d20afdbc1a94b44c022cbfeedfd17a19ffe75
-
memory/1688-20-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/1688-22-0x0000000004E90000-0x0000000004EA0000-memory.dmpFilesize
64KB
-
memory/1688-24-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/5068-0-0x00000000003E0000-0x0000000000408000-memory.dmpFilesize
160KB
-
memory/5068-1-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/5068-2-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/5068-3-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/5068-4-0x00000000050E0000-0x00000000050F0000-memory.dmpFilesize
64KB
-
memory/5068-5-0x0000000004E00000-0x0000000004E0A000-memory.dmpFilesize
40KB
-
memory/5068-6-0x0000000005060000-0x0000000005080000-memory.dmpFilesize
128KB
-
memory/5068-21-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB