5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5

Resubmissions

05-09-2023 01:34

230905-by5lrsch46 10

Analysis

max time kernel
96s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe
Size

2.6MB
MD5

838bf9e13202d1ceeac814788efe837b
SHA1

75b46cb896ccb9f3209ce235ebd5f62fb2c35b3d
SHA256

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff
SHA512

b75f12b8941843ee4141a017c61001f57f3e016cc5cd9530a0aad7478b4cb38b9fca5d5070e4f7f55417653bc6732db85db996ace60aa3c4f04c3454c6db3410
SSDEEP

49152:HdgDxc28AZaaE5CPuJIurzZuwWToqZsscWVYzRtYxZ7zgCBoL2I2/Re:HocbA0avPuhSToqZsscBzRin7zrI2pe

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3280 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3280	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe

description	pid	process	target process
PID 5080 wrote to memory of 3280	5080	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	regsvr32.exe
PID 5080 wrote to memory of 3280	5080	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	regsvr32.exe
PID 5080 wrote to memory of 3280	5080	e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe
"C:\Users\Admin\AppData\Local\Temp\e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /u /S J9SMW.NXS
2⤵
- Loads dropped DLL
PID:3280

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\J9SMW.NXS
Filesize
2.1MB

MD5
e53a4ae918b729caeeef26f1fb762c2c

SHA1
689e76a00d4d4957d63823b873f5277f6c8d0eb2

SHA256
0b18993e39094c2f85590ac4abcac3539bcf3f28d1e4c291567860992977459c

SHA512
919bd69b5eeb76e8a20b52d01b2df760a044610fafd336a22493cb707e28eab28308524dc9cc7e21ae5d3d0d08c68b9d13d5f5c8ad380e3648c27b3c9fd5c5c3

Download Submit
memory/3280-6-0x0000000000C30000-0x0000000000C36000-memory.dmp

Filesize
24KB

Download
memory/3280-4-0x0000000000400000-0x0000000000618000-memory.dmp

Filesize
2.1MB

Download
memory/3280-7-0x0000000002870000-0x000000000296C000-memory.dmp

Filesize
1008KB

Download
memory/3280-11-0x0000000002970000-0x0000000002A53000-memory.dmp

Filesize
908KB

Download
memory/3280-8-0x0000000002970000-0x0000000002A53000-memory.dmp

Filesize
908KB

Download
memory/3280-12-0x0000000002970000-0x0000000002A53000-memory.dmp

Filesize
908KB

Download
memory/3280-13-0x0000000002A60000-0x0000000003D31000-memory.dmp

Filesize
18.8MB

Download
memory/3280-14-0x0000000000400000-0x0000000000618000-memory.dmp

Filesize
2.1MB

Download
memory/3280-15-0x0000000003D40000-0x0000000003E17000-memory.dmp

Filesize
860KB

Download
memory/3280-16-0x0000000003E20000-0x0000000003EFC000-memory.dmp

Filesize
880KB

Download
memory/3280-19-0x0000000003E20000-0x0000000003EFC000-memory.dmp

Filesize
880KB

Download
memory/3280-20-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3280-21-0x0000000000690000-0x0000000000694000-memory.dmp

Filesize
16KB

Download