2bf2d3e3ec2092f5d851e83c5f85d1ad966d84ff2a93e60c9e818d14a32f3909

Analysis

max time kernel
78s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0de21cb578086435fc3f82c9329d0b0N.exe
Size

49KB
MD5

c0de21cb578086435fc3f82c9329d0b0
SHA1

416ed02e47ef61d1438bbe1be9f4de8577b0505c
SHA256

2bf2d3e3ec2092f5d851e83c5f85d1ad966d84ff2a93e60c9e818d14a32f3909
SHA512

e96c7b91054f2db673e6298542d3f02ee34e6820c610672c22093b0bef13519d1152927b6b23102831346bdb3e06a5bf310eb91d5159788d7dc453c11a9030ce
SSDEEP

768:Q8eRHO9lFh0ul16sh7iQroCH/f+RjFBSuB2XVCT:Q9lOZ16sh7iQroCuRB0uZT

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	c0de21cb578086435fc3f82c9329d0b0N.exe

Executes dropped EXE 1 IoCs

pid	Process
3744	bkgrnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0de21cb578086435fc3f82c9329d0b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bkgrnd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3744	4560	c0de21cb578086435fc3f82c9329d0b0N.exe	86
PID 4560 wrote to memory of 3744	4560	c0de21cb578086435fc3f82c9329d0b0N.exe	86
PID 4560 wrote to memory of 3744	4560	c0de21cb578086435fc3f82c9329d0b0N.exe	86

C:\Users\Admin\AppData\Local\Temp\c0de21cb578086435fc3f82c9329d0b0N.exe
"C:\Users\Admin\AppData\Local\Temp\c0de21cb578086435fc3f82c9329d0b0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
49KB

MD5
dea0df194ee08db564165c1af82c42b5

SHA1
d07af6f62c8f6ec0709041f110bebc01ff1ef68a

SHA256
5f476f43f071e1a181d5af384b494459e93c0385704d34ba5bd8bb9f0d496126

SHA512
be2bf7bb607609523e4b51f71760751a81a885d547c65a582c5f9083c140d199950ca3b530fe757badc910547d3a936c90ba58225a3803d5d41df09afba510d2

Download Submit
memory/3744-19-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4560-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4560-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4560-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4560-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download