Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
25/07/2024, 06:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
General
- Target e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe
- Size 247KB
- Sample240725-hc2rbatekn
- SHA256 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d
- MD5 e80a1d9a248c337a5d95f09776c0b092
- SHA1 4585f99e00ce0068f9a40893b4741b5151066173
- SHA512 3c42c682236638a61d3ec6323fc633eb92eab9118e589ab012d407231069b974232d36bfa823dce6f9d24e618cd68fc9ac95b541966d6a4562a3d40b3dc5c04a
- SSDEEP 3072:xrRbOKH6aSZYEGhm0OWh5bSpEC2lrGCH:x1OWSZYlOWfSpENo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
systembc
C2
-
31.44.185.6:4001
-
31.44.185.11:4001
Signatures
-
resource yara_rule behavioral2/files/0x000900000002345d-3.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation NmKfkd.exe - Executes dropped EXE 3 IoCs
pid Process 2956 NmKfkd.exe 1284 xlhe.exe 1616 NmKfkd.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe NmKfkd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe NmKfkd.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE NmKfkd.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe NmKfkd.exe File opened for modification C:\Program Files\7-Zip\7z.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe NmKfkd.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe NmKfkd.exe File opened for modification C:\Program Files\dotnet\dotnet.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE NmKfkd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe NmKfkd.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe NmKfkd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe NmKfkd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe NmKfkd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE NmKfkd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe NmKfkd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe NmKfkd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe NmKfkd.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\xlhe.job e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe File opened for modification C:\Windows\Tasks\xlhe.job e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3000 4616 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NmKfkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NmKfkd.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" NmKfkd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" NmKfkd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" NmKfkd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ NmKfkd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" NmKfkd.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4616 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe 4616 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2956 4616 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe 86 PID 4616 wrote to memory of 2956 4616 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe 86 PID 4616 wrote to memory of 2956 4616 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe 86 PID 2956 wrote to memory of 4116 2956 NmKfkd.exe 91 PID 2956 wrote to memory of 4116 2956 NmKfkd.exe 91 PID 2956 wrote to memory of 4116 2956 NmKfkd.exe 91 PID 1284 wrote to memory of 1616 1284 xlhe.exe 98 PID 1284 wrote to memory of 1616 1284 xlhe.exe 98 PID 1284 wrote to memory of 1616 1284 xlhe.exe 98 PID 1616 wrote to memory of 3016 1616 NmKfkd.exe 99 PID 1616 wrote to memory of 3016 1616 NmKfkd.exe 99 PID 1616 wrote to memory of 3016 1616 NmKfkd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe"C:\Users\Admin\AppData\Local\Temp\e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\NmKfkd.exeC:\Users\Admin\AppData\Local\Temp\NmKfkd.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\123f43a9.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 4922⤵
- Program crash
PID:3000
-
-
C:\ProgramData\xlama\xlhe.exeC:\ProgramData\xlama\xlhe.exe start1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\TEMP\NmKfkd.exeC:\Windows\TEMP\NmKfkd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\705f1c41.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4616 -ip 46161⤵PID:444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\xlama\xlhe.exe
- Size 247KB
- SHA256 e77eb0d03b445cf74f20c2614b1135b62da61ecf0d7c48194b71b8f73297272d
- MD5 e80a1d9a248c337a5d95f09776c0b092
- SHA1 4585f99e00ce0068f9a40893b4741b5151066173
- SHA512 3c42c682236638a61d3ec6323fc633eb92eab9118e589ab012d407231069b974232d36bfa823dce6f9d24e618cd68fc9ac95b541966d6a4562a3d40b3dc5c04a
- SSDEEP 3072:xrRbOKH6aSZYEGhm0OWh5bSpEC2lrGCH:x1OWSZYlOWfSpENo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MDMHN06X\k2[1].rar
- Size 4B
- SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
- MD5 d3b07384d113edec49eaa6238ad5ff00
- SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
- SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\123f43a9.bat
- Size 187B
- SHA256 703cc1e9f31289a9c023b9ea0df6e518582fb30da09d2ab728fb8edfcfe3dda3
- MD5 613922f6be4901c9ad52c18033b2664c
- SHA1 5c3beb8bc4110a302a0e0e3cd5b25b5cc4c03f0d
- SHA512 9dcfe2e596f77d6b8b0ed1b27d4d5fdd1a77b484b89fc6164e520320e047ca52e3f716bc90ee41fbf211bdd4d01036de96efc2cfb715578afade0926075c795b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\703A1833.exe
- Size 4B
- SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
- MD5 20879c987e2f9a916e578386d499f629
- SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
- SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\NmKfkd.exe
- Size 15KB
- SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
- MD5 f7d21de5c4e81341eccd280c11ddcc9a
- SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
- SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
- SSDEEP 384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\705f1c41.bat
- Size 133B
- SHA256 50652a023de56633b18e3de3efca680176b784e424ff7797ce833ea96aaf2cd2
- MD5 1f35bf8634aca1cb781a3b3b5b90dd24
- SHA1 913b7648b9f928dff32619f7645a75cc4c01ca67
- SHA512 8491b41b10a00235cbcf6eba533cfebeb2c7d6cbe80cd786dc628d44902c4b2abf071e2c2798f76f24fd5ce2b835ddc5393c9bb25143edce84067c57487cd6a7
- MD5 SHA1 SHA512