Resubmissions

15-08-2024 11:42

240815-nt6pgsvcmj 7

15-08-2024 11:37

240815-nrkz1avbpj 10

15-08-2024 11:36

240815-nqyjpsvbmq 10

15-08-2024 11:33

240815-npbcsavbjm 10

Analysis

  • max time kernel
    26s
  • max time network
    21s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-08-2024 11:36

General

  • Target

    ae1265e9fe0ac39bbe970a3fa66c64b0N.exe

  • Size

    282KB

  • MD5

    ae1265e9fe0ac39bbe970a3fa66c64b0

  • SHA1

    9239a5d795a2d97e72e7bd9b48b125d0e2459960

  • SHA256

    87a574cbf6233e2fd7a3872da22451ae49f6248cca5c900dab49207e0f0135b0

  • SHA512

    ff66d820fd16cc06ee99b995b1de7aa22d545da35518a1b02c5d5dee6a2d6c8670d3c3ba6934c0f0ebeaadb577c9de91dd9db8f8b27d1636f4f7514a6b4430a5

  • SSDEEP

    6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfQ:boSeGUA5YZazpXUmZhZ6Sp

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae1265e9fe0ac39bbe970a3fa66c64b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1265e9fe0ac39bbe970a3fa66c64b0N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
      "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
        "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
        3⤵
          PID:1008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

      Filesize

      282KB

      MD5

      9b5367092ff3a75fef7c0ce9f8e5c41b

      SHA1

      dd2b6cd3536436e42b6c4b0bb30d815502c8c163

      SHA256

      b1628c7693da2efc60ac42669299a2be7528806f3517c9362231b3acf13e6e7b

      SHA512

      465f233ee48270b0acf9d97020e7f7d60d651b1b998f65f40cdd5bbe23c1074ce0de45a48b13c61ce27bc51a9ce5dd0aa0095f0b75dc95fd4fc9ddaf5d5c851c

    • memory/1128-25-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/1128-24-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/1128-23-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/1128-21-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-6-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-0-0x00000000748A2000-0x00000000748A3000-memory.dmp

      Filesize

      4KB

    • memory/4592-7-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-5-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-22-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-4-0x00000000748A2000-0x00000000748A3000-memory.dmp

      Filesize

      4KB

    • memory/4592-3-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-2-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB

    • memory/4592-1-0x00000000748A0000-0x0000000074E51000-memory.dmp

      Filesize

      5.7MB