0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe
Size

279KB
MD5

ad43da66d700517a190142ebdb90dc94
SHA1

4e89407dd9771209487d8348167ae44bcfb69c7e
SHA256

0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558
SHA512

38cd117622435c0fd0bc6ed424e862715bad8c78a5cc07ca6c58ff2b00f4cedc22bd004d52122ccb1f3c94efc2183577bfa59caabe95355cafe649e949f1c92e
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKi:boSeGUA5YZazpXUmZhZ6Si

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe

Executes dropped EXE 1 IoCs

Processes:

a1punf5t2of.exe

pid process

4964 a1punf5t2of.exe

pid	process
4964	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exea1punf5t2of.exe

description	pid	process	target process
PID 4248 wrote to memory of 4964	4248	0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe	a1punf5t2of.exe
PID 4248 wrote to memory of 4964	4248	0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe	a1punf5t2of.exe
PID 4248 wrote to memory of 4964	4248	0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe	a1punf5t2of.exe
PID 4964 wrote to memory of 4980	4964	a1punf5t2of.exe	a1punf5t2of.exe
PID 4964 wrote to memory of 4980	4964	a1punf5t2of.exe	a1punf5t2of.exe
PID 4964 wrote to memory of 4980	4964	a1punf5t2of.exe	a1punf5t2of.exe

C:\Users\Admin\AppData\Local\Temp\0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe
"C:\Users\Admin\AppData\Local\Temp\0b0f0193b45a1178ecbc00c07c2b985adec07d21a03d7d4fafd3bf8d53aa7558.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
3⤵
PID:4980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
Filesize
279KB

MD5
818bdfb25db64046c95cae44fc9a79fe

SHA1
3795d8ca5b222e84f834807f36f06f4488b8a12c

SHA256
cb7404425735e6b7dec14b40d305e61c5cc4cd9457faf724850babf03c35b45a

SHA512
6a3c9929e6ee504821ba4f83b6c265ee032b85e75a9905947304513c78d7ecd48c04b9b85b25818cb898773f4a768963a7e7c3f26ff135e426f5118a13d8c1b3

Download Submit
memory/4248-0-0x0000000075162000-0x0000000075163000-memory.dmp

Filesize
4KB

Download
memory/4248-1-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4248-2-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4248-3-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4248-17-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4964-18-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4964-19-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/4964-21-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download