d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70

General

Target

d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe
Size

2.7MB
MD5

abadb9b84acb333457f282616f69f4f3
SHA1

6efe1132c1616a19dbe6442fe116f2ce1c7fe0a2
SHA256

d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70
SHA512

78c4777841d268e6da7181f05ce40eeed8f3cf7f6ba929c3dc3d187d53d04b6e704f65ed05a8228da9719381987cfa4ffadeb4ae15c4c063efcf95894872298f
SSDEEP

49152:6BuZrEUzSp9ZtayEudMZvIN+x0USKIy029s4C1eH9J:ckLzSp9uyEvcht29s4C1eH9J

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp

Executes dropped EXE 4 IoCs

pid	Process
5060	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
1280	662e6415d99c4_pe.exe
3060	662e6415d99c4_pe.tmp

Loads dropped DLL 3 IoCs

pid	Process
5060	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
3060	662e6415d99c4_pe.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kiwi X Executor.exe\unins000.dat	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
File created	C:\Program Files (x86)\Kiwi X Executor.exe\is-3GG67.tmp	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
File opened for modification	C:\Program Files (x86)\Kiwi X Executor.exe\unins000.dat	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 5060	4276	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	82
PID 4276 wrote to memory of 5060	4276	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	82
PID 4276 wrote to memory of 5060	4276	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	82
PID 5060 wrote to memory of 3100	5060	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	84
PID 5060 wrote to memory of 3100	5060	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	84
PID 5060 wrote to memory of 3100	5060	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	84
PID 3100 wrote to memory of 3480	3100	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	86
PID 3100 wrote to memory of 3480	3100	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	86
PID 3100 wrote to memory of 3480	3100	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe	86
PID 3480 wrote to memory of 1280	3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	88
PID 3480 wrote to memory of 1280	3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	88
PID 3480 wrote to memory of 1280	3480	d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp	88
PID 1280 wrote to memory of 3060	1280	662e6415d99c4_pe.exe	89
PID 1280 wrote to memory of 3060	1280	662e6415d99c4_pe.exe	89
PID 1280 wrote to memory of 3060	1280	662e6415d99c4_pe.exe	89

C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe
"C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\is-C35PS.tmp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-C35PS.tmp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp" /SL5="$90048,1969677,832512,C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe
    "C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe" /SILENT /PASSWORD=4992348
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\is-MOUL8.tmp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MOUL8.tmp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp" /SL5="$A0048,1969677,832512,C:\Users\Admin\AppData\Local\Temp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.exe" /SILENT /PASSWORD=4992348
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\is-GEHJ2.tmp\662e6415d99c4_pe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GEHJ2.tmp\662e6415d99c4_pe.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\is-ASA8M.tmp\662e6415d99c4_pe.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ASA8M.tmp\662e6415d99c4_pe.tmp" /SL5="$30206,922170,832512,C:\Users\Admin\AppData\Local\Temp\is-GEHJ2.tmp\662e6415d99c4_pe.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4ASPK.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ASA8M.tmp\662e6415d99c4_pe.tmp

Filesize
3.1MB

MD5
4e0a9a7a0c12d25c6b67c742827ddf8a

SHA1
c92fd154c6186d0e70842cba39404f3fc259458e

SHA256
d8f90eab209c685882975d33b495d7d0e5a120e2234026079df7196c0c971222

SHA512
01af6d10113402eedca03b77da92a8da2aea1f5690a1841328c8f24b3b9a033b24b284a30df4a5265c16f0e8c6ed6116d6d14a47ab4d1ab1585f8059e3a945ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C35PS.tmp\d4b9634d170017f5ef0b9303798174e502464d0921e0cba3bb7ac8c23fd50c70.tmp

Filesize
3.1MB

MD5
fdf835740d3c64e0faaede72648ba767

SHA1
b72763901b2f77013b19cde13930d7c0fae3adc1

SHA256
aa761321b8e6f38bd74006b14e1cff57c46032ddf3343ec6874e36155ab00588

SHA512
9eebee08744f39b5eb6f17442222e2864cbbcc06046ca65a19b808aacaa6fce81641be7b06746bd34cda47899b2d7b849412e20e67ec0d5e5c5066e63fd18de8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GEHJ2.tmp\662e6415d99c4_pe.exe

Filesize
1.7MB

MD5
6e5867177666001a645d0d1ec3352182

SHA1
253f2cffb2ffe5fc3815def517a30507b4f5dd83

SHA256
0ae2c6a7047fce664a8de09dd8848cbc46e262d21a96207369e059bc8b460714

SHA512
c9d106001d908752648c6ef859b13de2748159a757763dc3e4f779d130be0cfe038c6cdc56075d0eb136c5b7f0fa1d16c30de74d67c145d69d1eeab209bc50fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SBG4A.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/1280-49-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1280-36-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3060-50-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3100-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3100-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3100-47-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3480-27-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3480-48-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-19-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4276-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4276-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/5060-17-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/5060-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing