8b860e90bde517f64cf4fff7675101dda466ee4f258023f8458d0dd28b0b309a

Analysis

max time kernel
99s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

003b14cf420e13c6e01fb9f18efd7ef0N.exe
Size

45KB
MD5

003b14cf420e13c6e01fb9f18efd7ef0
SHA1

d7a2fe17297852891d3a70a503d76a832d46fc86
SHA256

8b860e90bde517f64cf4fff7675101dda466ee4f258023f8458d0dd28b0b309a
SHA512

66af8ebc6243f777b48dbf57c59454002efe607a25d44a28cf209ec8611cb1c69dd166b97ec801d633718aed9c0a32feb9548d744f845dd8ecaa4f9bf12bd04d
SSDEEP

768:Q8eRHO9lFh0ul16sh7iQroCH/f+RjFBSuB2XACl:Q9lOZ16sh7iQroCuRB0uIl

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	003b14cf420e13c6e01fb9f18efd7ef0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4052	bkgrnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	003b14cf420e13c6e01fb9f18efd7ef0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bkgrnd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4052	4296	003b14cf420e13c6e01fb9f18efd7ef0N.exe	84
PID 4296 wrote to memory of 4052	4296	003b14cf420e13c6e01fb9f18efd7ef0N.exe	84
PID 4296 wrote to memory of 4052	4296	003b14cf420e13c6e01fb9f18efd7ef0N.exe	84

C:\Users\Admin\AppData\Local\Temp\003b14cf420e13c6e01fb9f18efd7ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\003b14cf420e13c6e01fb9f18efd7ef0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
45KB

MD5
0e2b6bf778cf25267d8bd1aee6d19f11

SHA1
89f3f41ed9ba3674f323a326455ce04307b3545e

SHA256
309b0b0b6c8eafbbccfa612f5b1fdad4e06ce4a7edc6e4bf1463a8bb8b8670e1

SHA512
364301c7296d6c97c51ecc0f767a8a649331b43fe63983f505433aab59831441188060a99fec1c0e65459148ff66c285f29c8c1d47fe50ab019be3663d48140b

Download Submit
memory/4052-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4296-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4296-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4296-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4296-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download