616580b4f0292b2a93b957cca624683a7b8d750807ab6c0ef9dda6e6920ca1cf

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FModel.exe
Size

30.3MB
MD5

b4ebf2a58ad70f931c581e639cfe88c4
SHA1

3f2ac147cdd474c22cf54e40dcfb7863e8494369
SHA256

616580b4f0292b2a93b957cca624683a7b8d750807ab6c0ef9dda6e6920ca1cf
SHA512

eb09e5035bb776b97bd96a4582d24b72dc199b54f14c724b161c4bdc1b21f273432a53eda4ff7d45ae03e3bcd3920e1fe1d028959de919b0df3d3fb396c4db18
SSDEEP

196608:AxxDjECsn99bg7s3dwzJD3Z40DbTlqWchPL/TUyuVyAh+TZOENCzVknONqV5m4n0:Axx3ECOF3dwtCER/sZOzGnOY55n0

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	FModel.exe

Loads dropped DLL 2 IoCs

pid	Process
1064	FModel.exe
1064	FModel.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	FModel.exe

C:\Users\Admin\AppData\Local\Temp\FModel.exe
"C:\Users\Admin\AppData\Local\Temp\FModel.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Output\.data\oo2core_9_win64.dll

Filesize
569KB

MD5
f2db01967705b62aecef3cd3e5a28e4d

SHA1
4bcc73614cb8fd2b0bce8d0f91ee5f3202d9d624

SHA256
19452ae1abae65e1305d3818354d4fae7b1200294322f0d9c6d5ddeb7bd9f978

SHA512
d442fa32e7490bfb39ebf052d2d81cb52b504c26f25a710e83e3ef1e57abc428b3ee8d942777666af25c991ba84c458fa84cccccefcef67212499edfe5ac3a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Output\.data\zlib-ng2.dll

Filesize
119KB

MD5
2adb5439b8b14ebaf379614ec5f567da

SHA1
af1ddb91a9f7544ff0c5ceb6d398e0cde417a02c

SHA256
8876b9bf6eee5bb3244237beb9e5223be46002fc815fdc086485b90013c804e5

SHA512
de721d6a29ce2cb59ca1ab5555432aca2571c2b58ccc02cd84e1ed7982a7d8629c181f7d12453b5de640f22e93bb1af1fb7e6e866e1719c1fb53cff59082706e

Download Submit