58c3cf89f91a4eb69b861b5db317830e15f640e9b3d7eadfb12fd3c48a901820

General

Target

b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe
Size

14KB
MD5

5423cc2f70cf3c502c9387442c6c5768
SHA1

7a73f73b178127dcdea2b377e927bb5bd8287cd2
SHA256

b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea
SHA512

8b427757a9d205f77f1f27f9b07e3de5d5651bab57275ac2ab44e8a3c56a61465a7da66dc0a38e73d7c2899c3e2536ed0bcd5b37ddf06dea94e992733b1decd2
SSDEEP

384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYt:hDXWipuE+K3/SSHgxmt

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEM955A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEMEC63.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEM42FF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEM992E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEMEF5C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe

Executes dropped EXE 6 IoCs

pid	Process
2840	DEM955A.exe
4440	DEMEC63.exe
1604	DEM42FF.exe
744	DEM992E.exe
488	DEMEF5C.exe
5112	DEM453D.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM453D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM955A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMEC63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM42FF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM992E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMEF5C.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2840	4068	b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe	96
PID 4068 wrote to memory of 2840	4068	b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe	96
PID 4068 wrote to memory of 2840	4068	b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe	96
PID 2840 wrote to memory of 4440	2840	DEM955A.exe	102
PID 2840 wrote to memory of 4440	2840	DEM955A.exe	102
PID 2840 wrote to memory of 4440	2840	DEM955A.exe	102
PID 4440 wrote to memory of 1604	4440	DEMEC63.exe	105
PID 4440 wrote to memory of 1604	4440	DEMEC63.exe	105
PID 4440 wrote to memory of 1604	4440	DEMEC63.exe	105
PID 1604 wrote to memory of 744	1604	DEM42FF.exe	107
PID 1604 wrote to memory of 744	1604	DEM42FF.exe	107
PID 1604 wrote to memory of 744	1604	DEM42FF.exe	107
PID 744 wrote to memory of 488	744	DEM992E.exe	116
PID 744 wrote to memory of 488	744	DEM992E.exe	116
PID 744 wrote to memory of 488	744	DEM992E.exe	116
PID 488 wrote to memory of 5112	488	DEMEF5C.exe	121
PID 488 wrote to memory of 5112	488	DEMEF5C.exe	121
PID 488 wrote to memory of 5112	488	DEMEF5C.exe	121

C:\Users\Admin\AppData\Local\Temp\b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe
"C:\Users\Admin\AppData\Local\Temp\b7169a795e600f323e165407b0724290ed46cf86190c5f78a733d294a59edcea.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\DEM955A.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM955A.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\DEMEC63.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMEC63.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\DEM42FF.exe
      "C:\Users\Admin\AppData\Local\Temp\DEM42FF.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\DEM992E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM992E.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\DEMEF5C.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMEF5C.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\DEM453D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM453D.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DEM42FF.exe

Filesize
14KB

MD5
c1603892c99d1ca24957b24fc654a4ce

SHA1
520fc1586dc35b2f043bf71ce7d304c9b5f4d3fb

SHA256
8660b2d17cb7ca49aaffaaf9726f77913dc46a094afdc90da936d447cbeea51d

SHA512
dbf5ee23fcd8b94f8b9e0bd69cfb93ab36a6c9272feefc7510c0a95de4f171855acde3e66061f9806783cef4b97a92aaae21219debc874af5213be21ebf845b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEM453D.exe

Filesize
14KB

MD5
53154c69cc72514a2ce7e9494cacb598

SHA1
ed55f2506b6cd7cf67adf47464e1c160a71bdaf0

SHA256
1b0ebaeae24dcf68f309d2834ce0a7b7c80776129cdb1830675b6c9bbf4aaf08

SHA512
2bb2f8ad44fb7eb1a92a0bd87d421317f75be95a31cb5b16d5fae71b33e9e592ea3281d954882773da95413151740812f88f85467c6a8cef8054b4926b74e92f

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEM955A.exe

Filesize
14KB

MD5
1c2f73f6fb51cb5118cccdb1eeecdfe6

SHA1
5a8c31576f35fbf76edea4432354284dce167afe

SHA256
d437145ef2fb6f94bd5ab25df8f31e0da76a309de3993542262f824661d9e0c7

SHA512
f73cb3312c8c9b35db7dd05cee9c7111f0c16f15b2c5fdd4e16e198db55376809bbc87222c1506bf7d63576708d0baa30b82ef944170678cefc39ab4fe976b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEM992E.exe

Filesize
14KB

MD5
ae6d734e45225197fde6ca02e1e9f1a4

SHA1
ed99212ebc24831736fa02ddccdd3c065033e1e6

SHA256
2bbe6ff1bf46947f6e11fe7b97cffb777c2bf42668ceb2d04fba50ebfa16cc2f

SHA512
86094d2ec99969d6305c8f94340e951a77b12d1a8264dc5a6bfa1f9100a44e7b491eda4720e2b460bbabafc07488695072b49c86b516a0169affacefcf741fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEMEC63.exe

Filesize
14KB

MD5
c20e8c429b58b4700b7ac2d170e44501

SHA1
0ad84b43060b10b9e1a577a07cd9a4a15c3b1dab

SHA256
e66892501155f8b7586168bf67b323d1da89c8ccd5d41b8fe57b9fe0f25edc9b

SHA512
b8aebe90e9dfe5c60aafce154eaeb56a153d786f161318abd94980bd46ecc481b66834275ef320dc91c2e9f6c912c17c2f7c36e57f1cbe18e3cc6c60ea1ee700

Download Submit
C:\Users\Admin\AppData\Local\Temp\DEMEF5C.exe

Filesize
14KB

MD5
b6b22463bc8dd362e428e8dbda1368f5

SHA1
ffd9a9accd9cde01a5024ab00664c5855cc96405

SHA256
5c6b5048185dc56d09104c771bdc14a552f03eeeeeb7b3e0d4398ece1f394b3b

SHA512
51319977fe9b691d2801aaa2b58811c4dc595ce132c1b6e6bf9bd8a36f503aa00bb7b70a3617504ca78e8f0514bab5ff6c40585ee7067d3dd666b08670c7a27c

Download Submit

Analysis

Sharing