bc79148b69b99467279eb60ca1babbc79afb7fe57b9942750373aed6ea32d3ad

General

Target

e2f53dc75c55a54521c1d305d01e67d0N.exe
Size

50KB
MD5

e2f53dc75c55a54521c1d305d01e67d0
SHA1

8a20dd313a6fa3223aaea21198b4fce48981673f
SHA256

bc79148b69b99467279eb60ca1babbc79afb7fe57b9942750373aed6ea32d3ad
SHA512

5119b946a828f2ef02b83eb925db784b79bba8801b223a53ab277f378871d409dff0bda6b5d958cd6e514d981572817714593765fb4f91cc523a25cc6406f527
SSDEEP

1536:MLdY8B4HFqn5yZHALya6idstrrrd++CCCCpN:seHon5yZHDa6istrrrd++CCCCH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	e2f53dc75c55a54521c1d305d01e67d0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4960	vgkhost.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4856-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4856-3-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4856-4-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-12-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-13-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-14-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-16-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-18-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/4960-19-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\vgkhost.exe	e2f53dc75c55a54521c1d305d01e67d0N.exe
File opened for modification	C:\Windows\Debug\vgkhost.exe	e2f53dc75c55a54521c1d305d01e67d0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2f53dc75c55a54521c1d305d01e67d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vgkhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vgkhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vgkhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4856	e2f53dc75c55a54521c1d305d01e67d0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3380	4856	e2f53dc75c55a54521c1d305d01e67d0N.exe	87
PID 4856 wrote to memory of 3380	4856	e2f53dc75c55a54521c1d305d01e67d0N.exe	87
PID 4856 wrote to memory of 3380	4856	e2f53dc75c55a54521c1d305d01e67d0N.exe	87

C:\Users\Admin\AppData\Local\Temp\e2f53dc75c55a54521c1d305d01e67d0N.exe
"C:\Users\Admin\AppData\Local\Temp\e2f53dc75c55a54521c1d305d01e67d0N.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E2F53D~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380

C:\Windows\Debug\vgkhost.exe
C:\Windows\Debug\vgkhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\vgkhost.exe

Filesize
50KB

MD5
a8af6839deb07f02fb969dc7e66fa847

SHA1
719bde5432d2b5e3b00c2bc63e4ccccc714bed5c

SHA256
b55513aab1a8eee9acc0f553fb677e5ee24d488f41eaa88996f3b9df80f4e48a

SHA512
8e3e0a7ddfd99f6312534301dbf07261e612993e3b2d29a4bdbe206df572ea246f187972aa14af5a8b9fb3d37d3ff8a742de7645a057460dec1a9d20274e567a

Download Submit
memory/4856-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4856-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4856-4-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-12-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-13-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-14-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-16-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-18-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4960-19-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads