3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4

General

Target

3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe
Size

1.4MB
MD5

633a8069e3b232bcc9f800cfc5f12ac3
SHA1

09ca4984514bed5f8d8ba54ba64497b793022a3e
SHA256

3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4
SHA512

4dc53d2503718f310a2b43f3f57cd0b8164ae47533ca95f65a42f12c6c0984d9d8bba71e994d2eb65697a6638b84f4af657d1d9a91213a12c7b273476d16af2a
SSDEEP

24576:CZkcYXyNjbvkEhkmWbay5h1XYQOQQ5rtwD24BXcO9hbj0d:CZksjbJkmu1XYn7/wyVebj

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	scegli_nome.exe
3984	scegli_nome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\scegli_nome.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 3984	2716	scegli_nome.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2788	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	scegli_nome.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2788	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	81
PID 3860 wrote to memory of 2788	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	81
PID 3860 wrote to memory of 2788	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	81
PID 3860 wrote to memory of 2716	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	83
PID 3860 wrote to memory of 2716	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	83
PID 3860 wrote to memory of 2716	3860	3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe	83
PID 2716 wrote to memory of 3984	2716	scegli_nome.exe	84
PID 2716 wrote to memory of 3984	2716	scegli_nome.exe	84
PID 2716 wrote to memory of 3984	2716	scegli_nome.exe	84
PID 2716 wrote to memory of 3984	2716	scegli_nome.exe	84
PID 2716 wrote to memory of 3984	2716	scegli_nome.exe	84

C:\Users\Admin\AppData\Local\Temp\3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe
"C:\Users\Admin\AppData\Local\Temp\3e5069922731d5e61614684f16fcd1625a1f02e5011a809acd2066071900e8b4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\scegli_nome.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2788
- C:\Users\Admin\AppData\Roaming\scegli_nome.exe
  "C:\Users\Admin\AppData\Roaming\scegli_nome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Roaming\scegli_nome.exe
    "C:\Users\Admin\AppData\Roaming\scegli_nome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\scegli_nome.exe

Filesize
1.4MB

MD5
93a627f71e0490022c44f57876e66d13

SHA1
2b4b8d45c3badc650b1279457c71fa0ea50ce625

SHA256
3bdb00ded770187e0f1c47a5a8dd88f3877469c0a835496e952d8a662a30c61f

SHA512
41f31d912dd667fbe1e1876dde0c4c49d6253b87c5d130d7906d75696a1a81c11b18e45d5a65ae8d88d3f92ea1fd7853ace399daca5a6f6f1c4c4bd817cfb503

Download Submit
memory/2716-17-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/2716-12-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2716-13-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/3860-1-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/3860-11-0x0000000000400000-0x0000000000571000-memory.dmp

Filesize
1.4MB

Download
memory/3860-0-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3984-16-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3984-14-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3984-18-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3984-20-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3984-19-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3984-21-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads