Analysis
-
max time kernel
119s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 14:14
Behavioral task
behavioral1
Sample
ea8eeedd4d60124bd1cc481a262cedb0N.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
ea8eeedd4d60124bd1cc481a262cedb0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
ea8eeedd4d60124bd1cc481a262cedb0N.exe
-
Size
20KB
-
MD5
ea8eeedd4d60124bd1cc481a262cedb0
-
SHA1
c922097aa537177590c15e612dbfddafa8809787
-
SHA256
126fc67445a74a51d1b9caace03d2fa16f24b4045c689fbc23f5d2021c4fa8d1
-
SHA512
c00907c5097d96bbd68efe05d9004887c95492ee765b4e4596008ba317ec77e51d684d3cae99071f26c778c72c5642f234ee77f44eb1a0444146b5fc69e98a4d
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU:9KE7pXaNJawcudoD7U7S5Ev
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation ea8eeedd4d60124bd1cc481a262cedb0N.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 xplorer.exe -
resource yara_rule behavioral2/memory/2856-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000e0000000233ac-16.dat upx behavioral2/memory/2856-26-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2948-28-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe ea8eeedd4d60124bd1cc481a262cedb0N.exe File opened for modification C:\Windows\xplorer\xplorer.exe ea8eeedd4d60124bd1cc481a262cedb0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea8eeedd4d60124bd1cc481a262cedb0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe Token: SeDebugPrivilege 2948 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 2948 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2856 wrote to memory of 3524 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 90 PID 2856 wrote to memory of 3524 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 90 PID 2856 wrote to memory of 3524 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 90 PID 3524 wrote to memory of 1604 3524 cmd.exe 93 PID 3524 wrote to memory of 1604 3524 cmd.exe 93 PID 3524 wrote to memory of 1604 3524 cmd.exe 93 PID 2856 wrote to memory of 2948 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 94 PID 2856 wrote to memory of 2948 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 94 PID 2856 wrote to memory of 2948 2856 ea8eeedd4d60124bd1cc481a262cedb0N.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea8eeedd4d60124bd1cc481a262cedb0N.exe"C:\Users\Admin\AppData\Local\Temp\ea8eeedd4d60124bd1cc481a262cedb0N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WCDAJ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1604
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD5275ac2d71a971f89c8d9ca8ae4552be6
SHA1fa87d8202422debbca25b987e82eaa236c6e99c4
SHA2564c522e72bc2149606c769323f56d064760509bc7a4730f00711f19de6d89534d
SHA512fd40acb82419bfd154a327e827ab0e4aabbcc3a54d33a5b7271225011979259b7b779256a49232811a361598e80e944e68c2594cc335ee6552fa6cd3505df4ae