Analysis
-
max time kernel
108s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 07:27
Static task
static1
Behavioral task
behavioral1
Sample
6c444d97906346930901ba6270b704a0N.exe
Resource
win7-20240704-en
General
-
Target
6c444d97906346930901ba6270b704a0N.exe
-
Size
56KB
-
MD5
6c444d97906346930901ba6270b704a0
-
SHA1
c97be1f5bd111a9be5219d844787863d49f13a1b
-
SHA256
168fb7063c7124b99bc523aa831fc3bccc5f64f3b3699911157b258bc883c834
-
SHA512
f65c78942416316e04ac42427b458a753a1bb6dc3c2dfc80d7cb99687ceed889c650194a660b2003c097f692b51b69e0a84d02ec4b1c3a68e6c181116521eff4
-
SSDEEP
1536:vMcQYte55zs091Zw9FAGDdJYipvwGf9ogjrgHDh:vMhAe5Zs091KI+JYixw49Xjr+
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6c444d97906346930901ba6270b704a0N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 6c444d97906346930901ba6270b704a0N.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 4196 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exe6c444d97906346930901ba6270b704a0N.exebiudfw.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c444d97906346930901ba6270b704a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6c444d97906346930901ba6270b704a0N.exedescription pid process target process PID 1072 wrote to memory of 4196 1072 6c444d97906346930901ba6270b704a0N.exe biudfw.exe PID 1072 wrote to memory of 4196 1072 6c444d97906346930901ba6270b704a0N.exe biudfw.exe PID 1072 wrote to memory of 4196 1072 6c444d97906346930901ba6270b704a0N.exe biudfw.exe PID 1072 wrote to memory of 4036 1072 6c444d97906346930901ba6270b704a0N.exe cmd.exe PID 1072 wrote to memory of 4036 1072 6c444d97906346930901ba6270b704a0N.exe cmd.exe PID 1072 wrote to memory of 4036 1072 6c444d97906346930901ba6270b704a0N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe"C:\Users\Admin\AppData\Local\Temp\6c444d97906346930901ba6270b704a0N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:4036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD595d700a5a67ebbd78b5d280b574661ee
SHA1f947b96343538dba0371e09e8eff1f22914ff800
SHA25650b642b5b37f9f6f49358111350dd616634e813d8643d3efc971b202cb385712
SHA512d01b9c28cc31de1c7cf3e6896f4e8439cee3b6a67e43f5f5eef232da58f41875499c6e7e27314265431407e1836acc71c81013b816cfc51f5056ceae2e2ae3c7
-
Filesize
512B
MD5b4a86880004da8726288d7ec954885a8
SHA11bab1cfbdc2c540246210bc7852f8fe7e8357b31
SHA256c85016a9115aeb492bf116ab05791a9c3e6e30c39274767bd0476bd56a37db46
SHA51222758f6c6de591c99f8f9857c1b03e55c242f0a4987d376b08c30bc608027d1574a228a8230099ddac2a3214663396b016e85d085204155a5ec26f87a28496b4
-
Filesize
276B
MD5ac92f394868bdc5b84692156171d2d6e
SHA12fb1837134d6faa8ffd63b3ff79725dea187c5a0
SHA256d572f192902d38f9d318306a2beb77f9fa7c79aef5010dd17152323ce80d8850
SHA512e85a8ca9dcd8810ce1d99978499a0be7edb10f8ef56b2e33c8c80d733098659ede0f4d912a1843567a8333becdf8cc2d39dc0711c69b4783d0db80e983d9c520