7e8e1b0b4ce282e22661de58d25566dbb93667614e5feb10d462b7dfed2ef9db

Resubmissions

08-08-2024 12:34

240808-prr9ratclq 10

08-08-2024 12:23

240808-pks8gaxbld 10

08-08-2024 12:21

240808-pjlr1axbke 10

Analysis

max time kernel
591s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cxdyz/Flexer.exe
Size

143KB
MD5

d0b566a81cc36166344998426d351695
SHA1

79d9be955801bb25ffafc3a216a80cde82de1519
SHA256

b2a9cad37ba737f306f2523f8d46866705ff038e437cb342eb2255c1f9329a89
SHA512

5df8e27cff7e6716b49899c0d55d1962243b008b6cee775559198c318e2797f8c159d4469d03e9b2b552ad4d4f4d59903426383fba30ca436280bc19b002a4f6
SSDEEP

3072:HAi4pxpEHmAdx4/kyHRZa0YiRAl278IVn2JbS1cJs8lWxj:HAi4pxpRkyHRZa0Gl278IVNc+cWx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Flexer.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation Flexer.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

3 pastebin.com

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Flexer.exe

flow	ioc
3	pastebin.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Flexer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Flexer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Flexer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Flexer.exe

C:\Users\Admin\AppData\Local\Temp\Cxdyz\Flexer.exe
"C:\Users\Admin\AppData\Local\Temp\Cxdyz\Flexer.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3852,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3916,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:8
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-0-0x0000022EEC410000-0x0000022EEC411000-memory.dmp

Filesize
4KB

Download