83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe
Size 12KB
Sample240603-amkxjsdf53
SHA256 83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1
MD5 33e38b96bc63adf5437334978c714c9d
SHA1 c339ae9f0a2519496546d51a938ca405fe9ad6db
SHA512 63f2c1b3e496c7d55a4d8e60afb99e4c1e1f1b1f22ced14a395bd4d26841c813125e5e583228dc361919e3b1e3fb7fdcb3f1c3db70bc67428ed91d24fda6f8c3
SSDEEP 384:7L7li/2zqq2DcEQvdhcJKLTp/NK9xaAX:v6M/Q9cAX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe

Deletes itself 1 IoCs

pid	Process
3252	tmp5843.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3252	tmp5843.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 5104	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	85
PID 4436 wrote to memory of 5104	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	85
PID 4436 wrote to memory of 5104	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	85
PID 5104 wrote to memory of 4844	5104	vbc.exe	87
PID 5104 wrote to memory of 4844	5104	vbc.exe	87
PID 5104 wrote to memory of 4844	5104	vbc.exe	87
PID 4436 wrote to memory of 3252	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	88
PID 4436 wrote to memory of 3252	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	88
PID 4436 wrote to memory of 3252	4436	83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe	88

C:\Users\Admin\AppData\Local\Temp\83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe
"C:\Users\Admin\AppData\Local\Temp\83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ftxnpmm5\ftxnpmm5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF49310EE7FEA4614ADA4ACD68AFD4DFA.TMP"
    3⤵
    PID:4844
- C:\Users\Admin\AppData\Local\Temp\tmp5843.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5843.tmp.exe" C:\Users\Admin\AppData\Local\Temp\83dbbc97d76a233388b61b4c42e7a3262ecf1b4cb9ad892036d32000baf334a1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RE.resources

Path C:\Users\Admin\AppData\Local\Temp\RE.resources
Size 2KB
SHA256 8a913daad27129c510d8e7da6bb2c73711dab036972496f915cf9996bbf4468f
MD5 a3eacc7b0731ad65b5166c942d5b1ca2
SHA1 ff7efeebdb6d0e3e9c0076e9ab1dbf3121068767
SHA512 a196aaa8d651c676a22f6d22842bd4e9a0239416f9454916dcdb4ab3cb6589f7bb745ed494df202fb9e2dd96969b76be02929c23d47506340d59f77a45c2f0a3
MD5 SHA1 SHA512

Submit Download

RES59B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES59B9.tmp
Size 1KB
SHA256 d0947a683728a0479383b47ab56dafa53d6e8faffae1bc73a193d4383a8b30fd
MD5 2ef6679cc46ef6fd1064a738d7344fdd
SHA1 c819f5c022e9c3e7210eb8d11d643891078e2be5
SHA512 30ea8045b70a61766528d3b3f8b5db377dcf260cb8c734400d33e054b8ef086b26050407aaad6bd93a2a17cf2ca48d7453730891c25712ee705fbd29fe99a50e
MD5 SHA1 SHA512

Submit Download

ftxnpmm5.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ftxnpmm5\ftxnpmm5.0.vb
Size 2KB
SHA256 fd14ff4935df8c393e264be7ab71948acae34dfac60a7eaeffa80090174ae8ce
MD5 fd34ab7ea14dd17f2df76b30ab76fa60
SHA1 844e71092b4c0c8a5e850214479fd036d3248867
SHA512 7f9f5ffaeeab935d98c83b7479da8091033b16664793e86bde0ecddb1fd5dcabc2f902faa5b7c9d2f55c17ea9809c1cf21b34649ef4629b2a69a49c6f0a3be30
MD5 SHA1 SHA512

Submit Download

ftxnpmm5.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ftxnpmm5\ftxnpmm5.cmdline
Size 273B
SHA256 0e61f851156d27b58a58bf5bdea0153a43985839ccd90ef9a05d591bfaaa502e
MD5 a86bbb9a8be4348f3b9119d97ff01cbb
SHA1 3e5f3560a200cb025381f08a221bf639140341ba
SHA512 980c1a6b8b6e0eed8289cb89c6eb1ee7eba0be6ef567156bfd3afd619da9c69d9d8da798034d01adc11d8bf35231e3cfaf874ca9d1c69336b85e54b26186fcc0
MD5 SHA1 SHA512

Submit Download

tmp5843.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5843.tmp.exe
Size 12KB
SHA256 fafca4bb05b93b6c66c09b8240d911ec1ab289857d274c088e1b9e42e8a0254c
MD5 c4b3bf5720908708748a8ba46281c5e2
SHA1 8cbbc8be0a35736607bdf5f22edcb7cb5362e2ee
SHA512 355c39053543612be735ede4c7faa8df21bed7d1f8df1cec67692fd7f5b86ae839e1d9dfc1e47fc5a1931e70bdfda5500d70bb5bf9885fc11738e3a98a0f48c4
SSDEEP 384:dL7li/2z0q2DcEQvdfcJKLTp/NK9xauW:N4MZQ9cuW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcF49310EE7FEA4614ADA4ACD68AFD4DFA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF49310EE7FEA4614ADA4ACD68AFD4DFA.TMP
Size 1KB
SHA256 ec38dfe9e3da7ee203d99379ba42f146e2869619f14d1a75df089529e2e85879
MD5 05ac06e11a2a7c5bc5fdbd46d48b281c
SHA1 c66d9ddafe627eb43bac7e2cd4a03d3b5d5b0707
SHA512 dc9c2801de5109469e96005db64a3328fd0975d1b5a32266f7d31966bd715bd29b75f4590aa62157757d316fa9b6f5799daf9c4c1f21786c6cbbc0308797b19d
MD5 SHA1 SHA512

Submit Download

memory/3252-25-0x0000000000070000-0x000000000007A000-memory.dmp

Download

memory/3252-26-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download

memory/3252-27-0x0000000004FF0000-0x0000000005594000-memory.dmp

Download

memory/3252-28-0x0000000004A40000-0x0000000004AD2000-memory.dmp

Download

memory/3252-30-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download

memory/4436-0-0x0000000074E1E000-0x0000000074E1F000-memory.dmp

Download

memory/4436-8-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download

memory/4436-2-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Download

memory/4436-1-0x00000000006A0000-0x00000000006AA000-memory.dmp

Download

memory/4436-24-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads