39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe
Size 137KB
Sample240704-ecp6qsvdmf
SHA256 39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545
MD5 986bc47d1b0a81e13f3563269f543790
SHA1 7d651dc71a4fa25db318daa755e0af5ff1918435
SHA512 5eba05177aade9052ac34516027b74b4b2f5c31ae3314dec450d79e49eef0f19061825a1c54b43dda7d26c92530bcb5edcde2b5e6f2df8b2fde48850bc38359d
SSDEEP 1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKj:xPd4n/M+WLcilrpgGH/GwY87mVmIXT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe

Executes dropped EXE 1 IoCs

pid	Process
4260	wn2ra4ohzdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4260	3672	39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe	86
PID 3672 wrote to memory of 4260	3672	39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe	86
PID 3672 wrote to memory of 4260	3672	39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe	86
PID 4260 wrote to memory of 1296	4260	wn2ra4ohzdr.exe	89
PID 4260 wrote to memory of 1296	4260	wn2ra4ohzdr.exe	89
PID 4260 wrote to memory of 1296	4260	wn2ra4ohzdr.exe	89

C:\Users\Admin\AppData\Local\Temp\39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe
"C:\Users\Admin\AppData\Local\Temp\39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
    "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
    3⤵
    PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wn2ra4ohzdr.exe

Path C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
Size 137KB
SHA256 18ec9f2be242db85a8e1cba2876d65f215fb81d66a1ebe119a0977ed05b2eafc
MD5 91bd6730eb7bcf1893c56189fb70820c
SHA1 0252fdbf78072c888dece0438edfb28760eeebf4
SHA512 c8a32c76e7a7121920ad783d4213c54dbf057f81ee333d0c5e66b1f1689a3971c39c702a69ec28f98d1e38d554c4a90e853a029f7f665bc76dd30d0a78c08233
SSDEEP 1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKO:xPd4n/M+WLcilrpgGH/GwY87mVmIXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3672-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Download

memory/3672-1-0x0000000000010000-0x0000000000038000-memory.dmp

Download

memory/3672-2-0x0000000005080000-0x0000000005624000-memory.dmp

Download

memory/3672-3-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Download

memory/3672-4-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Download

memory/3672-5-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/3672-6-0x0000000004CD0000-0x0000000004CF0000-memory.dmp

Download

memory/3672-20-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/4260-21-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/4260-22-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/4260-24-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads