17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f

Analysis

max time kernel
34s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe
Size

413KB
MD5

1fbe8dd021615ff072695234fbe98db6
SHA1

04e1a86d6342978db8571b7fc017f5d55f9378cb
SHA256

17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f
SHA512

838011c000cf3a0f4b36e9cc9f843b191fe5ce82b34d34341152ec4a21ae0f0e86101059aee656956ac1862ed6ce510bf125e0a0f1c22ddf5de86f20dd3bfeb4
SSDEEP

6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUJ:ITNYrnE3bm/CiejewY5vO

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	ximo2ubzn1i.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c5e4gxfvd4v = "C:\\Users\\Admin\\AppData\\Roaming\\c5e4gxfvd4v\\ximo2ubzn1i.exe"	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ximo2ubzn1i.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 2656	724	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe	84
PID 724 wrote to memory of 2656	724	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe	84
PID 724 wrote to memory of 2656	724	17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe	84
PID 2656 wrote to memory of 4852	2656	ximo2ubzn1i.exe	87
PID 2656 wrote to memory of 4852	2656	ximo2ubzn1i.exe	87
PID 2656 wrote to memory of 4852	2656	ximo2ubzn1i.exe	87

C:\Users\Admin\AppData\Local\Temp\17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe
"C:\Users\Admin\AppData\Local\Temp\17a40124df589c5f58baeb1021793d7c8258841a89e564d37416579982d9820f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe
  "C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\c5e4gxfvd4v\ximo2ubzn1i.exe

Filesize
413KB

MD5
8c91a0391f3bfb39a35cbb70c9295d66

SHA1
6c56257202d0fa242bc91c9ebf510ce4681bbaa3

SHA256
5c197f1845bcfccad371f1111872ada6a304dde583d56d7e17a9c630bfb5f10e

SHA512
c0e3275f3ed6bb6c0babf8e5c85ef861f39bc4112695d5cd0bdf46c2795c5c02cf7d72800ffb5bee1e1de35e3901ac10c3c6683d5e8bd3f9d4af131292c22159

Download Submit
memory/724-6-0x00000000050D0000-0x000000000510C000-memory.dmp

Filesize
240KB

Download
memory/724-2-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/724-3-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/724-4-0x0000000004C20000-0x0000000004C2A000-memory.dmp

Filesize
40KB

Download
memory/724-5-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/724-0-0x00000000749EE000-0x00000000749EF000-memory.dmp

Filesize
4KB

Download
memory/724-1-0x00000000001A0000-0x000000000020E000-memory.dmp

Filesize
440KB

Download
memory/724-21-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2656-20-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2656-22-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2656-23-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/2656-25-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads