c9e7703faad3960594c4a4135f5ca3a6dca4dd0113af162e56b50c30fc55fa45

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7d3425a23b5b8d3d00eded5b83c0710N.exe
Size 281KB
Sample240806-s3c6rawgph
SHA256 c9e7703faad3960594c4a4135f5ca3a6dca4dd0113af162e56b50c30fc55fa45
MD5 c7d3425a23b5b8d3d00eded5b83c0710
SHA1 f58026846eeb92e4999fbca16578d41c144fceed
SHA512 f3a7408856bcf97d22bfb2a6f07bfe45252b306bca374aa43cffccf7408864a6095d48af90930fb983fe9820b2f7797c8752fc4405d10927d3620aa279087a50
SSDEEP 6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fK8:boSeGUA5YZazpXUmZhZ6S8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	c7d3425a23b5b8d3d00eded5b83c0710N.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	c7d3425a23b5b8d3d00eded5b83c0710N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7d3425a23b5b8d3d00eded5b83c0710N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4860	2504	c7d3425a23b5b8d3d00eded5b83c0710N.exe	86
PID 2504 wrote to memory of 4860	2504	c7d3425a23b5b8d3d00eded5b83c0710N.exe	86
PID 2504 wrote to memory of 4860	2504	c7d3425a23b5b8d3d00eded5b83c0710N.exe	86
PID 4860 wrote to memory of 3932	4860	a1punf5t2of.exe	87
PID 4860 wrote to memory of 3932	4860	a1punf5t2of.exe	87
PID 4860 wrote to memory of 3932	4860	a1punf5t2of.exe	87

C:\Users\Admin\AppData\Local\Temp\c7d3425a23b5b8d3d00eded5b83c0710N.exe
"C:\Users\Admin\AppData\Local\Temp\c7d3425a23b5b8d3d00eded5b83c0710N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1punf5t2of.exe

Path C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
Size 281KB
SHA256 7821cffe27ba8b113562c7c2e3baebbc1a7c8c63cef8ac8aa1d0220dd9456ce2
MD5 791a10fd1c80039cb9e3f4d2667e75f3
SHA1 850af1ddc02a37a7660cd3c2a05e40875943fd7b
SHA512 b5a3e8c1286135e78c4f7c45a7f37dbaf271c50dadbcef75f166d9ea80069c6ecad4201eda9c0d2d9a7461e677e6eaa82465c16cb12c59f34edff7e5a5010be3
SSDEEP 6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKb:boSeGUA5YZazpXUmZhZ6Sb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2504-0-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/2504-1-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/2504-2-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/2504-3-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/2504-17-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4860-19-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4860-18-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4860-20-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4860-22-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads