99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81

General

Target

99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe
Size

5.3MB
MD5

496d60dac38d7cc0df82e6d94e2ba7c5
SHA1

1ecbaba1caa209afaf3749d30a7f13bfa04d37e0
SHA256

99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81
SHA512

69fb8f41da9454d8cf989e4823c4b41d84a0eaa9289b8baf744e494f7b8fac5c2279ad08decae7c75cc8c466c0b5369251142697ec939adb5efb1f275853b149
SSDEEP

98304:oeV2RdpF0BIsndGaX6tJJQv2FKA75OpVclc02vDRZTEo:1V2fpF0imo3u0jc02vVZoo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	nemu-downloader.exe

Executes dropped EXE 4 IoCs

pid	Process
2628	nemu-downloader.exe
2636	ColaBoxChecker.exe
960	HyperVChecker.exe
840	HyperVChecker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2628	nemu-downloader.exe
2628	nemu-downloader.exe
2628	nemu-downloader.exe
2628	nemu-downloader.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2628	4124	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	87
PID 4124 wrote to memory of 2628	4124	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	87
PID 4124 wrote to memory of 2628	4124	99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe	87
PID 2628 wrote to memory of 2636	2628	nemu-downloader.exe	98
PID 2628 wrote to memory of 2636	2628	nemu-downloader.exe	98
PID 2628 wrote to memory of 2636	2628	nemu-downloader.exe	98
PID 2628 wrote to memory of 960	2628	nemu-downloader.exe	101
PID 2628 wrote to memory of 960	2628	nemu-downloader.exe	101
PID 2628 wrote to memory of 840	2628	nemu-downloader.exe	103
PID 2628 wrote to memory of 840	2628	nemu-downloader.exe	103

C:\Users\Admin\AppData\Local\Temp\99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe
"C:\Users\Admin\AppData\Local\Temp\99bc60d0975ce5dc3ef53a6db87c55b512cdf9d3b937350ecb4dd88287b64c81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\7z79EA201C\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z79EA201C\nemu-downloader.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\7z79EA201C\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z79EA201C\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\7z79EA201C\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z79EA201C\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\7z79EA201C\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z79EA201C\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z79EA201C\ColaBoxChecker.exe

Filesize
4.0MB

MD5
839708e3f96cf055436fa08d6205263c

SHA1
a4579f8cb6b80fe3fd50099794f63eb51be3292f

SHA256
1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752

SHA512
ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z79EA201C\HyperVChecker.exe

Filesize
117KB

MD5
dbd84c6083e4badf4741d95ba3c9b5f8

SHA1
4a555adf8e0459bfd1145d9bd8d91b3fff94aad0

SHA256
9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39

SHA512
fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z79EA201C\baseboard

Filesize
115B

MD5
286d402fd7041be449af0b5cc1c3a5f1

SHA1
ca1961a3bcd0ae0697c1d303f824862d7998ca5a

SHA256
f3e88232c249794599fd757ee05ab72294d5bf23baba0520ee49e0c028ae214e

SHA512
cdfd032ede5f88df1d3e648f4448c28153067b75dec00c1734b72768e8bd32a86bc6138ddf2d41b82603020dcae9fdb991ee55bd2aeb4a969e8f7b7fc035d2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z79EA201C\config.ini

Filesize
353B

MD5
d07d0cbdc62effb1028505d0a4c8fa0f

SHA1
7013e566476d899e883109d5f52522d95e97ccb4

SHA256
2787e6215c962e58a1c80fd01a78e63437c7c6995d6cdd7f1e3a89393793552d

SHA512
f2907720de4a45adde7b9a9d02ed900d52f6d56c6c22c84c4b47782d1c621d7cc0ea1d936d7820255af3048ec5baa4f363b19e711f53c3dc8ff01f5f9ac29dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z79EA201C\nemu-downloader.exe

Filesize
3.2MB

MD5
c972d67cc128640dadceb178940080ce

SHA1
5a4a8a5eb7cd498397dfea938cf82372f27443f1

SHA256
17fadeae847897edce01db445632899da7314e05244327e4d88d828c8275be80

SHA512
725ecd661fb17681b2d26bac5f23de6d4503ccd004e8359ba6f772644e2b6b21f3ca4c9c2d7be8ae30881deabaf34419d2a5f9a15acdc447c89db9a9e81c71fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z79EA201C\skin.zip

Filesize
508KB

MD5
e7230d7304337bb3184cdd3fa3da051a

SHA1
59f0de7785874d02071a855df81f9ba6e6e8f0ec

SHA256
c3a8d7a715099ea60a3e6142f880e0be6737ed920f90bea391c75cb7625e513d

SHA512
7273a59f0486431003190a8d2d0dfc6799a4f28666ba144219afa5956742d15c1ba277a69d16e18891bfddffe562527714e2240fea8ce3498822d96b57672abd

Download Submit

Analysis

Sharing