Resubmissions
15/08/2024, 11:42
240815-nt6pgsvcmj715/08/2024, 11:37
240815-nrkz1avbpj1015/08/2024, 11:36
240815-nqyjpsvbmq1015/08/2024, 11:33
240815-npbcsavbjm10Analysis
- max time kernel
110s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
15/08/2024, 11:33
General
- Target ae1265e9fe0ac39bbe970a3fa66c64b0N.exe
- Size 282KB
- Sample240815-npbcsavbjm
- SHA256 87a574cbf6233e2fd7a3872da22451ae49f6248cca5c900dab49207e0f0135b0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae1265e9fe0ac39bbe970a3fa66c64b0N.exe"C:\Users\Admin\AppData\Local\Temp\ae1265e9fe0ac39bbe970a3fa66c64b0N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
a1punf5t2of.exe
memory/696-23-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-22-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-29-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-27-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-26-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-25-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/696-24-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-5-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-21-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-1-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-2-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-0-0x00000000746F2000-0x00000000746F3000-memory.dmp
memory/2144-6-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-7-0x00000000746F0000-0x0000000074CA1000-memory.dmp
memory/2144-4-0x00000000746F2000-0x00000000746F3000-memory.dmp
memory/2144-3-0x00000000746F0000-0x0000000074CA1000-memory.dmp