7e8e1b0b4ce282e22661de58d25566dbb93667614e5feb10d462b7dfed2ef9db

Resubmissions

08/08/2024, 12:34

240808-prr9ratclq10

08/08/2024, 12:23

240808-pks8gaxbld10

08/08/2024, 12:21

240808-pjlr1axbke10

Analysis

max time kernel
591s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cxdyz/Flexer.exe
Size 143KB
Sample240808-prr9ratclq
SHA256 b2a9cad37ba737f306f2523f8d46866705ff038e437cb342eb2255c1f9329a89
MD5 d0b566a81cc36166344998426d351695
SHA1 79d9be955801bb25ffafc3a216a80cde82de1519
SHA512 5df8e27cff7e6716b49899c0d55d1962243b008b6cee775559198c318e2797f8c159d4469d03e9b2b552ad4d4f4d59903426383fba30ca436280bc19b002a4f6
SSDEEP 3072:HAi4pxpEHmAdx4/kyHRZa0YiRAl278IVn2JbS1cJs8lWxj:HAi4pxpRkyHRZa0Gl278IVNc+cWx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Flexer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Flexer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Flexer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Flexer.exe

C:\Users\Admin\AppData\Local\Temp\Cxdyz\Flexer.exe
"C:\Users\Admin\AppData\Local\Temp\Cxdyz\Flexer.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3852,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3916,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:8
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-0-0x0000022EEC410000-0x0000022EEC411000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads