eb39e3c3215ee01a3ed0148766b22b139d1cf42a3631b7c99144ae2d181bbb8c

Analysis

max time kernel
134s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2017.6.30/013.exe
Size 12KB
Sample240830-ck7dwascka
SHA256 674f00e2033ebaf0623a4b6425be8a19d2cbd0a93e0d9a5d0e6d015b1c0f01eb
MD5 3315df622f775f8028c281e409c1cc3f
SHA1 a87af661190ec765b7c2a5451b43c1236b8cfa93
SHA512 fad0327c71baa4a820230f11ad87d5468cabb37644dc31f64a3a399e36a5111f49da6c61577e0fe14eb51961ddb1b39245ee6811f80c8364376540135c019abd
SSDEEP 192:e/kxEcepRqIjzb2UyIGCrMN8A+rai4vDZ4Ty7UVmka1Sk3pe:esCcARlzbXjGCpA+WDZ4u7UVs1SI8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	013.exe

Loads dropped DLL 1 IoCs

pid	Process
1312	013.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral26/memory/1312-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral26/memory/1312-19-0x0000000010000000-0x0000000010008000-memory.dmp	upx
behavioral26/memory/1312-29-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1912	1312	013.exe	86
PID 1312 wrote to memory of 1912	1312	013.exe	86
PID 1312 wrote to memory of 1912	1312	013.exe	86
PID 1912 wrote to memory of 3220	1912	cmd.exe	90
PID 1912 wrote to memory of 3220	1912	cmd.exe	90
PID 1912 wrote to memory of 3220	1912	cmd.exe	90
PID 1312 wrote to memory of 2552	1312	013.exe	91
PID 1312 wrote to memory of 2552	1312	013.exe	91
PID 1312 wrote to memory of 2552	1312	013.exe	91

C:\Users\Admin\AppData\Local\Temp\2017.6.30\013.exe
"C:\Users\Admin\AppData\Local\Temp\2017.6.30\013.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\find.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\findstr.exe
    findstr /v "*" b64defile.dat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tempfile.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Base64.dll

Path C:\Users\Admin\AppData\Local\Temp\Base64.dll
Size 12KB
SHA256 e2e29c39eace3bd0642756b99e15605ff27670e54c05fe16c1903453541268e6
MD5 f5f1f0e62d243ee6b9559427fb410595
SHA1 7b7e5234b0913044abfd4fc335673eeac05e8f61
SHA512 0f32224f412ff9b7631d67ca1da1f29ea813aea4e775b7f81bcade4c041a453e7775d2480297b2e3dccf2999e3490b616b8592b86b18d833a574cfb70e248763
SSDEEP 192:acj5pwZYPEMEMX7oNKUJzw/L/JDeFNJX8txv7jbMJy/Ltp1Unm3jn0rB:dR7oNKbL/JDeFsLv/VvWmTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

b64defile.dat

Path C:\Users\Admin\AppData\Local\Temp\b64defile.dat
Size 258B
SHA256 80233da30916501e8399cfa1c7776aa1372cb1a625c8a338e061e0f359a1fa0b
MD5 a88837e1d7250a0b14d8ca37d966aacd
SHA1 6351c2a36693c0af63473a623e126e7b32b3cf47
SHA512 d9dfd08c3f6920f52f1e042e9f0c557836cc446284346271648ea6c2c0bc86d4d571d28c5e2a0397d6f7d376f4cbf398932d4c3a1f3db13fe86f6d67fb7cfdd1
MD5 SHA1 SHA512

Submit Download

find.bat

Path C:\Users\Admin\AppData\Local\Temp\find.bat
Size 45B
SHA256 42b6336804239e8348bf5e3ade3351cfba567b357316a956192d78788bd805d0
MD5 abfa5cda8733742a8a4c513d4a2b91e1
SHA1 95ba6154bee9fd5f3f437dbf7fed2e5290387848
SHA512 df7462bff4388399ea452d87251b4fb550e5fde65b961ac5dcc04afc51177f3b481c0d7d3879a526a6055bc63925d1902500390abfcdd08d61e21d5dd27c14c7
MD5 SHA1 SHA512

Submit Download

tempfile.bat

Path C:\Users\Admin\AppData\Local\Temp\tempfile.bat
Size 136B
SHA256 608ad8f2881b7afbebf6ffa5b92dbdd77ffb3a696f14cdc7c4e275923692b57c
MD5 7e9facac5d837bf9b55195250847d49e
SHA1 831266b7943a9546b47e0839ad1030577bf0d307
SHA512 be6e47bbacf698d37d65e1688adafe3d0a4670152fec3326dd114b0a76023658396531b72d5b32d956ad12dc87ce3dc11759f1f2550e44490b4f9bae53be2173
MD5 SHA1 SHA512

Submit Download

memory/1312-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1312-19-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/1312-29-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads