ce63f32e218780e78c1c6809c7f47b9105edd5980450d61881ea14311b5511d5

General

Target

55b78c947cfe5364c1af28c90343a070N.exe
Size

282KB
MD5

55b78c947cfe5364c1af28c90343a070
SHA1

2e287abf7dd0a7f2d9aba8bf9045eaa6081ad01a
SHA256

ce63f32e218780e78c1c6809c7f47b9105edd5980450d61881ea14311b5511d5
SHA512

ab670c08519173fdb1bd03852bba127f9302e945a69769a6dbf4c3a0f98378cf437ffc3a10b09093780c18c142444a9d8aefab3de69c7d90e0e21fba4dbc645d
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfI:boSeGUA5YZazpXUmZhZ6S5

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	55b78c947cfe5364c1af28c90343a070N.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	55b78c947cfe5364c1af28c90343a070N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55b78c947cfe5364c1af28c90343a070N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2324	1104	55b78c947cfe5364c1af28c90343a070N.exe	97
PID 1104 wrote to memory of 2324	1104	55b78c947cfe5364c1af28c90343a070N.exe	97
PID 1104 wrote to memory of 2324	1104	55b78c947cfe5364c1af28c90343a070N.exe	97
PID 2324 wrote to memory of 4028	2324	a1punf5t2of.exe	98
PID 2324 wrote to memory of 4028	2324	a1punf5t2of.exe	98
PID 2324 wrote to memory of 4028	2324	a1punf5t2of.exe	98

C:\Users\Admin\AppData\Local\Temp\55b78c947cfe5364c1af28c90343a070N.exe
"C:\Users\Admin\AppData\Local\Temp\55b78c947cfe5364c1af28c90343a070N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
282KB

MD5
d77f670150dbb85a61ecc67818f56b6e

SHA1
000f5a8f26ec65fd5ef10afbd725b0c8b7e6eaa1

SHA256
3c490eaf0b41c4a0a61058d75a3bc3c9c61b96409032c5d242ece62c98e630ba

SHA512
0ca9b5ec060e6c18b139a686a3dae51bcd8fca99bbee52b6e8f059374e6a15d6ec2b39b02b168a82f39e7e5402dc847795e7f924d1ad164e3979e7097c7070d1

Download Submit
memory/1104-4-0x00000000755E2000-0x00000000755E3000-memory.dmp

Filesize
4KB

Download
memory/1104-7-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-3-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-0-0x00000000755E2000-0x00000000755E3000-memory.dmp

Filesize
4KB

Download
memory/1104-21-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-6-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-2-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-1-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/1104-5-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-22-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-24-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-23-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-25-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-26-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-27-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download
memory/2324-29-0x00000000755E0000-0x0000000075B91000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads