bfa1614b51ceb6dc880bf9246de9ebd0b37feaa576037f554b456d4ff3563652

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ce0cf5a55e9834f8572b2d0542f020N.exe
Size

62KB
MD5

98ce0cf5a55e9834f8572b2d0542f020
SHA1

e953cad5211dc93583641e1fdc6071f6f8603090
SHA256

bfa1614b51ceb6dc880bf9246de9ebd0b37feaa576037f554b456d4ff3563652
SHA512

ba8ec59cbb15e0ba327a6ed240321184b9f671e2b73cd73cfa3fec2e2d88605c05d3bdc38c3420d674d8af56e4b481a9b702861e087c075fa5b28086c5641db7
SSDEEP

768:PxdIm/hZGHrqE1H63A7HAiGWWpGs8b5mM7EyT2P9WADOsylVYm+uC5l:HIRvH63A7nepGs89mM7Q3DdOKmBe

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	98ce0cf5a55e9834f8572b2d0542f020N.exe

Executes dropped EXE 1 IoCs

pid	Process
1668	kqcpp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98ce0cf5a55e9834f8572b2d0542f020N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kqcpp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1668	3896	98ce0cf5a55e9834f8572b2d0542f020N.exe	86
PID 3896 wrote to memory of 1668	3896	98ce0cf5a55e9834f8572b2d0542f020N.exe	86
PID 3896 wrote to memory of 1668	3896	98ce0cf5a55e9834f8572b2d0542f020N.exe	86

C:\Users\Admin\AppData\Local\Temp\98ce0cf5a55e9834f8572b2d0542f020N.exe
"C:\Users\Admin\AppData\Local\Temp\98ce0cf5a55e9834f8572b2d0542f020N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\kqcpp.exe
  "C:\Users\Admin\AppData\Local\Temp\kqcpp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kqcpp.exe

Filesize
62KB

MD5
e0cf19da71a553da11e6ac98aae63de1

SHA1
b2ee28213a94433821419474fa40b6283aeb1f4e

SHA256
f5bcdb6987bde824db76b44278f8a416f29f00eb817dd2bfff38cbeecb527603

SHA512
8bdb32d1fcd4bf4cb85b00d13423f7ceba7774c12a9b60d2b7e8d5945cea732e37e29fcb9e6d78df124759baa4e2b22bcf4359d99252467e41acda2bf275f2db

Download Submit
memory/1668-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3896-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download