Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:18
Behavioral task
behavioral1
Sample
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe
-
Size
20KB
-
MD5
2dd4a8a4c467a278b74ce6d0e170e390
-
SHA1
de28c86ab95df2751020e3432af2b2edd144ab55
-
SHA256
4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5
-
SHA512
e9ceb15ddab53b1bd4ac7413bdc453e0c31e78de5d48728aee3509ece44fc6a01cb15a36eaf119ee87982442fb624c38ac13c3fe3e1769f5979a60fed9cc9be3
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU2b:9KE7pXaNJawcudoD7U7S5Ev2b
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe -
Executes dropped EXE 1 IoCs
pid Process 4952 xplorer.exe -
resource yara_rule behavioral2/memory/2484-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00070000000234e0-16.dat upx behavioral2/memory/2484-26-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4952-28-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe Token: SeDebugPrivilege 4952 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 4952 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3304 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 82 PID 2484 wrote to memory of 3304 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 82 PID 2484 wrote to memory of 3304 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 82 PID 3304 wrote to memory of 1912 3304 cmd.exe 85 PID 3304 wrote to memory of 1912 3304 cmd.exe 85 PID 3304 wrote to memory of 1912 3304 cmd.exe 85 PID 2484 wrote to memory of 4952 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 86 PID 2484 wrote to memory of 4952 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 86 PID 2484 wrote to memory of 4952 2484 4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe"C:\Users\Admin\AppData\Local\Temp\4fb6b5e463ff6ebc36129ee06ea9ab19b2e4c8f12bd46d07a538581b04ba05c5N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\REIEB.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1912
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD53ba2163eaace5cbec7a0633f32fd244f
SHA17c112f3bb81b98c2225d2302e1990de79027bd54
SHA25674f0fc0384fc11136b3c73d76dab2c885fe91d1a284e4c97819e1cd077867744
SHA5123e4b646a8029c67dda72b383e029cb940b8c661c97caba2ea8357949fec2f76556d69f5bebccd6354792a3aeb1c157e4b5540177db33c39533b4e9aac3a5b2e4