Overview

overview

10

Static

static

10

4249f0d178...b6.exe

windows7-x64

4

4249f0d178...b6.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 01:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6.exe
  • Size 25.9MB
  • Sample240523-b3lpfshb86
  • SHA256 4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6
  • MD5 SHA1 SHA512 SSDEEP
Score
5/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • NTFS ADS 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6.exe
    "C:\Users\Admin\AppData\Local\Temp\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Registers COM server for autorun
    • Modifies registry class
    • NTFS ADS
    PID:4796

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HiveCloudBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\HiveCloudBridge.dll
        • Size 373KB
        • SHA256 645493a9bf5e3ec930aad78b5423a7533d6d8bd07aa182fab01d9f00dce3d8cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\Microsoft.Win32.Primitives.dll
        • Size 8KB
        • SHA256 ebdbe667f42c1f06ba6768bba71dbb4f62f29f05c091026813490a88c8de8793
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\Microsoft.Win32.Registry.dll
        • Size 24KB
        • SHA256 576ca9e0a8ae517760a077432cdb551db881c7eabcfac649b2f41fb2a4d5cb8b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Collections.Concurrent.dll
        • Size 48KB
        • SHA256 3fcb05263abd0c8ea40f2edefd064e007d568ca366abd9a54f2342df34333598
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Collections.dll
        • Size 27KB
        • SHA256 b6021312882fc8f2e935b29e2b8c1d1c76918ecf8c6d5120b31c7539e8c8435b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.ComponentModel.Primitives.dll
        • Size 19KB
        • SHA256 99c60fafddea89185dfeab9baaf90f064741e73442de32b1c01e5d25663720f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.ComponentModel.dll
        • Size 5KB
        • SHA256 6c0507ae88380aa86d11c2e3543ec616c3aa2a4cbde09fe19fc81c7502c204b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.IO.FileSystem.AccessControl.dll
        • Size 16KB
        • SHA256 69c2294e68848c9ffeb37e894434d9983038b6cb4d792adfab039f8f58e73909
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.DriveInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.IO.FileSystem.DriveInfo.dll
        • Size 16KB
        • SHA256 d22a88c7d18cc563d86aa8024d49ee06db251ab1a7aa6c2ea4ce65c4fa731542
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.Watcher.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.IO.FileSystem.Watcher.dll
        • Size 26KB
        • SHA256 11f9f264c26cd0308dc8af89da6c6cd781d2dcc23d66d07e75357239f33d7b41
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.Pipes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.IO.Pipes.dll
        • Size 42KB
        • SHA256 20ce24fbd8317fa5330cabe0d6918930ef0426a52a4896061360175d7dc24d89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Linq.Expressions.dll
        • Size 490KB
        • SHA256 3968d16df904c490d62f87da09fa8772d203804c9d8bc35531aadbf13b3743d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Linq.dll
        • Size 72KB
        • SHA256 c1b90d9858a88d9f31d2040154b6eb9bbe38348bf360f573de77be27cc762d36
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.Http.dll
        • Size 555KB
        • SHA256 85d3fc619ef35f580b390eba6aeccb166bc6e3e24bf4a99522ae50d14eca0468
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Mail.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.Mail.dll
        • Size 146KB
        • SHA256 f3edafb16312bbbf2030aae0978b7ad5a5e7b78354ccf1a4ba2627577247fd5b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.NameResolution.dll
        • Size 31KB
        • SHA256 722c7dc729cd49d48a7be25bd248fd7a38b80eafb1f7f1e831c419cbc6464cce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NetworkInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.NetworkInformation.dll
        • Size 33KB
        • SHA256 ec0cad7bb0c43260f5a5f912e4dd3c53edae71c9976f82a5a6ee60d37657c5bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.Primitives.dll
        • Size 67KB
        • SHA256 9e5a42e7bb0f35c83f30ebb39a61ef5473bffd62fa53bc96aa4a4193327d09a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Quic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.Quic.dll
        • Size 92KB
        • SHA256 6ea38895e746c8b40e83c66302c30f4a18c01d15648f98ed9616ef9f4e43b79c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Net.Security.dll
        • Size 174KB
        • SHA256 19530fe0a9c504f8405b6d39fe045ef581270f7e6eb1f7061bd6026efea27dd9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.ObjectModel.dll
        • Size 29KB
        • SHA256 18542b9351e9a6e6383cf97b3fe38e59ea13632a031e90035a9befcd2a8e3c2c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Private.CoreLib.dll
        • Size 2.5MB
        • SHA256 004b641bd65985015179d8f2827812768fc507df6403b8d6f69f0695efaf9b24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Private.Uri.dll
        • Size 75KB
        • SHA256 a9edb43d8742b0e0baaaa6eca7aa551f29516946adf5f50f951d53960d0f68eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Runtime.CompilerServices.Unsafe.dll
        • Size 5KB
        • SHA256 ae7f13dcea32e65f83f115e8b99c66e96abc35541f051bf796391579a99770ee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.RuntimeInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Runtime.InteropServices.RuntimeInformation.dll
        • Size 10KB
        • SHA256 90a585dffa34be5beebc4fc717cd5707a3dbcc6d0a2c6e1dd730e5130b7bc2e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Runtime.InteropServices.dll
        • Size 7KB
        • SHA256 73d9663969c8a2f2f28cb65570e5837c80a294050fb4e836f79e124d36410741
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Security.Claims.dll
        • Size 15KB
        • SHA256 2bcdf00c8147cdd52634f05f840d7b1b59d5e7c091a232094e21cdd121421d61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Security.Cryptography.Algorithms.dll
        • Size 98KB
        • SHA256 8ded0c4c31974c1fdde0c4eda80ca37fa835f5c43724a27ea213745adf564ccb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Security.Cryptography.Primitives.dll
        • Size 36KB
        • SHA256 87d02ebbd9e458692eb11564ca76fa5a8ef9b03b19c091abe7380d0395487eae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Security.Cryptography.X509Certificates.dll
        • Size 136KB
        • SHA256 3bb788b3222db236eec9ca86e580713c1addaa102a6da7720d17af3b8158ef78
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Security.Principal.Windows.dll
        • Size 50KB
        • SHA256 7e013be636adfaf3155c64205cc3f1b0def2a64fbbd8c496016b1dece8950e92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\4249f0d17868f8c1b3a3ce75d58ea21cd884d5a781a4b267ca712ed093cb82b6\Cbjpsw4hzscQZcfirbiXagjF2yy08PA=\System.Threading.dll
        • Size 17KB
        • SHA256 ff83498021addda7bd51d9ec30873c30a3b17fe947967acfd48be1c3816c0ef3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4796-149-0x00007FF76BB5E000-0x00007FF76BB5F000-memory.dmp
        Download

        memory/4796-341-0x00007FF76BB5E000-0x00007FF76BB5F000-memory.dmp
        Download