ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Size

839KB
MD5

803f39a10c4016eac37d86cd4b5e47c9
SHA1

2f3b456b5d398c45c912a7d7240830114db31572
SHA256

ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42
SHA512

cf4354345c612c56e2aac2719199fdeddda8f8c98556280aede08a40601fbda46d87a05ec96bbaa2bb06ee120a77adacc3ce87b82eb85607d23a7cf83696b932
SSDEEP

12288:E8kxNhOZElO5kkWjhD4AI/GtAtScw3qEKBaGtAtScw3qEKB:7qEkfFP145J145

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3740	XKG.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	XKG.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\System Volume Information\\SLRAQ.EXE \"%1\" %*"	XKG.EXE

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4596-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/files/0x000700000002346f-10.dat	upx
behavioral2/files/0x0009000000023411-18.dat	upx
behavioral2/memory/4596-21-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3740-22-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XLOLNJ.EXE = "C:\\System Volume Information\\XLOLNJ.EXE"	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\L:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\G:	XKG.EXE
File opened (read-only)	\??\N:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\U:	XKG.EXE
File opened (read-only)	\??\H:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\H:	XKG.EXE
File opened (read-only)	\??\K:	XKG.EXE
File opened (read-only)	\??\I:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\V:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\M:	XKG.EXE
File opened (read-only)	\??\P:	XKG.EXE
File opened (read-only)	\??\Q:	XKG.EXE
File opened (read-only)	\??\T:	XKG.EXE
File opened (read-only)	\??\O:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\Q:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\I:	XKG.EXE
File opened (read-only)	\??\J:	XKG.EXE
File opened (read-only)	\??\M:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\P:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\T:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\U:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\V:	XKG.EXE
File opened (read-only)	\??\K:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\R:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\S:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\E:	XKG.EXE
File opened (read-only)	\??\L:	XKG.EXE
File opened (read-only)	\??\N:	XKG.EXE
File opened (read-only)	\??\O:	XKG.EXE
File opened (read-only)	\??\R:	XKG.EXE
File opened (read-only)	\??\S:	XKG.EXE
File opened (read-only)	\??\E:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
File opened (read-only)	\??\J:	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XKG.EXE

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Users\\EWKBMG.EXE %1"	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\EWKBMG.EXE \"%1\""	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\System Volume Information\\SLRAQ.EXE \"%1\" %*"	XKG.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	XKG.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\System Volume Information\\XLOLNJ.EXE %1"	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\EWKBMG.EXE %1"	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\System Volume Information\\XLOLNJ.EXE \"%1\" %*"	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3740	XKG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3740	4596	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe	84
PID 4596 wrote to memory of 3740	4596	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe	84
PID 4596 wrote to memory of 3740	4596	ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe	84

C:\Users\Admin\AppData\Local\Temp\ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe
"C:\Users\Admin\AppData\Local\Temp\ea0c6c5e07e4f64c44585840c33813b643d9560d2caf584b9d6962e60e1e6f42.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4596
- C:\PerfLogs\XKG.EXE
  C:\PerfLogs\XKG.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\XKG.EXE

Filesize
839KB

MD5
549731afee6d4f5fc7e2f871771d13be

SHA1
13a29f68cf12c89aabd40d51375e34c8bded50ff

SHA256
8d2dc6016b13430e4200f3df59ab793bac0ba54850b56b0dabfa675e2e43103b

SHA512
3b2919573e6d3e6c1fb2617ff8b7aef6c132acf9a06b2967432c83cdc6ed73fd0992cc78d18b8cf2a3b05aa36bff0e9e15959f86b33d9b768805c280254a4b22

Download Submit
C:\Users\EWKBMG.EXE

Filesize
839KB

MD5
dc85903594125a128dc73e9143918aad

SHA1
30df61176f6101bdf56c36d89bba5e508693bcd0

SHA256
f52c7c8acd80fcd9f0b0fb2e8ff5de34cafe23ff008ed6d48eb115892f95b320

SHA512
393dfb0c8f82756b3723c3a5f6a34d3eb6365f8b90d724867d01e2552f276b1e94a0495beff74c132ce85f4887dfe732a8649ac6eacca074bae093b8c27cb0fb

Download Submit
\??\c:\filedebug

Filesize
289B

MD5
ab385a94ab631115dfa38fc9b145454d

SHA1
b2934bce4eeaefb11d1a7348cc5cac62533bd09e

SHA256
8a362f5c93db30a4c2b9eca922482b18010db5c87cfc8783ea8c9ab237066b46

SHA512
f5bd978ebfd6f170fb3e26a3a9a673112b6feb50ad53e416cf2e63031c1e9af213a191e4d086db7cddf77e2b79de37c61f14ed72877a0e90d9bb86afe14111f0

Download Submit
memory/3740-20-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3740-22-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3740-23-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/4596-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4596-1-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/4596-21-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads