6d233149cf42f476907c45a4e63329d00af0c78d9dafe6f9cc5a38784206db02

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fiddler.exe
Size

281KB
MD5

71776eeac76ac1591144338385374c5d
SHA1

2273f36d078d132c44a16a1564e9d9ff01334d51
SHA256

6d233149cf42f476907c45a4e63329d00af0c78d9dafe6f9cc5a38784206db02
SHA512

b3360011ff93b2ce892979848ad8a362c068ca28519668311e7312bfeccc4e4798751f0abd1cd531c42bbc79e2e42a108d26908b2e39f2c6783b011e3db93611
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkf/:boSeGUA5YZazpXUmZhZ6S2

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	fiddler.exe

Executes dropped EXE 1 IoCs

pid	Process
4384	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	fiddler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fiddler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4384	1800	fiddler.exe	97
PID 1800 wrote to memory of 4384	1800	fiddler.exe	97
PID 1800 wrote to memory of 4384	1800	fiddler.exe	97
PID 4384 wrote to memory of 2204	4384	a1punf5t2of.exe	98
PID 4384 wrote to memory of 2204	4384	a1punf5t2of.exe	98
PID 4384 wrote to memory of 2204	4384	a1punf5t2of.exe	98

C:\Users\Admin\AppData\Local\Temp\fiddler.exe
"C:\Users\Admin\AppData\Local\Temp\fiddler.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
281KB

MD5
622ac64dc9c18834c7695de3b1839fa5

SHA1
213ca2c8fec3191f51413496afb5e297baae6bcd

SHA256
4eb61e708ae7298e964eb3716a39f495201a17b1013c98d94ab2b6de379898d5

SHA512
813a9f71ecea54d72ff61b3108bbdf29a425ef11f4ff2f4d2747c67605f8a05dd10a4e86662709032abf6162f7d43939550cf89e30b658c991ddb0e2ce3f30bb

Download Submit
memory/1800-4-0x0000000075172000-0x0000000075173000-memory.dmp

Filesize
4KB

Download
memory/1800-7-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-3-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-0-0x0000000075172000-0x0000000075173000-memory.dmp

Filesize
4KB

Download
memory/1800-21-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-6-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-2-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-1-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/1800-5-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-22-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-23-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-24-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-25-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-26-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-27-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4384-29-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads