d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737

Resubmissions

13-07-2024 09:54

240713-lxbx6swdmm 10

13-07-2024 09:50

240713-lvbvdsyapd 10

13-07-2024 09:46

240713-lr1dksyajd 10

Analysis

max time kernel
1793s
max time network
1153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
Size

4.2MB
MD5

4755656e64a4cb4ee7ae5846acc1bbc1
SHA1

fd8f5007141ac941fcac77c6565ccb1ec86b1391
SHA256

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d
SHA512

6aecc49f717d19425256ef0dcfe5ee8fdd47e131d91322ef8f250d92935d55130226227e0a5f8d8a1d94f1a8f31c4325f026755610a15717a05df26a4c498af5
SSDEEP

98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4ulur:ovsJR0TW6yiIKRhzqOsr

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe

Deletes itself 1 IoCs

Processes:

GG9ND.exe

pid process

1528 GG9ND.exe
Executes dropped EXE 1 IoCs

Processes:

GG9ND.exe

pid process

1528 GG9ND.exe
Loads dropped DLL 2 IoCs

Processes:

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exeGG9ND.exe

pid process

4488 2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
1528 GG9ND.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

GG9ND.exe

pid process

1528 GG9ND.exe
1528 GG9ND.exe
1528 GG9ND.exe
1528 GG9ND.exe
1528 GG9ND.exe

pid	process
1528	GG9ND.exe

pid	process
1528	GG9ND.exe

pid	process
4488	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
1528	GG9ND.exe

pid	process
1528	GG9ND.exe
1528	GG9ND.exe
1528	GG9ND.exe
1528	GG9ND.exe
1528	GG9ND.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exeGG9ND.exe

description	pid	process
Token: SeDebugPrivilege	4488	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
Token: 0	4488	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
Token: SeDebugPrivilege	1528	GG9ND.exe
Token: 0	1528	GG9ND.exe
Token: SeShutdownPrivilege	1528	GG9ND.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe

description	pid	process	target process
PID 4488 wrote to memory of 1528	4488	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe	GG9ND.exe
PID 4488 wrote to memory of 1528	4488	2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe	GG9ND.exe

C:\Users\Admin\AppData\Local\Temp\2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
"C:\Users\Admin\AppData\Local\Temp\2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\GG9ND.exe
  "C:\Users\Admin\AppData\Local\Temp\GG9ND.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DIH\VAC.zip

Filesize
13KB

MD5
5a8e8dedf1d910c79defff5638978d07

SHA1
bfab518af8a53f02c4f98fc321aa0984a208686c

SHA256
d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893

SHA512
7acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\GG9ND.exe

Filesize
4.2MB

MD5
797d352d09c92351c1285944971dd4c3

SHA1
e626bf8af56f22dd674af3f19eb27c34ee311016

SHA256
024e7d480b091267fc3f2deaee4bb70c26e2025e729a69cf4a99a7166e3561b6

SHA512
15520abc87a8bcf5abcdbfabda789d396a87f074d10bdd9daf14bc5428104a33fc2b9d602f36371ab7db82e8eee518bb30a922a9831c32929a840ae33cda08e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x64\SciLexer.dll

Filesize
1.3MB

MD5
a70486cf41bf065ff8e76e8619745361

SHA1
e06e75380b17fec737fbdfeaa4a09b83e54d4838

SHA256
1563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858

SHA512
02f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0

Download Submit
memory/1528-45-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-44-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-41-0x000002BEF10C0000-0x000002BEF10D8000-memory.dmp

Filesize
96KB

Download
memory/1528-40-0x000002BEF1210000-0x000002BEF1396000-memory.dmp

Filesize
1.5MB

Download
memory/1528-36-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-34-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-5-0x00000120F7D60000-0x00000120F7EB4000-memory.dmp

Filesize
1.3MB

Download
memory/4488-14-0x00000120F8D40000-0x00000120F8D52000-memory.dmp

Filesize
72KB

Download
memory/4488-15-0x00000120F8D20000-0x00000120F8D2A000-memory.dmp

Filesize
40KB

Download
memory/4488-11-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-7-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-33-0x00000120F8DA0000-0x00000120F8E41000-memory.dmp

Filesize
644KB

Download
memory/4488-6-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-35-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-0-0x00007FF943903000-0x00007FF943905000-memory.dmp

Filesize
8KB

Download
memory/4488-4-0x00000120DF020000-0x00000120DF062000-memory.dmp

Filesize
264KB

Download
memory/4488-3-0x00000120F7C80000-0x00000120F7D60000-memory.dmp

Filesize
896KB

Download
memory/4488-2-0x00007FF943900000-0x00007FF9443C1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-1-0x00000120DCFA0000-0x00000120DD3D6000-memory.dmp

Filesize
4.2MB

Download