Analysis
-
max time kernel
119s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 01:42
General
-
Target
183281b306d4d06b0bd3e8805a60fd2db9ab8f743d47cb29beb56694614f7270N.exe
-
Size
646KB
-
MD5
58742fa74d16b336b4683d92de86bd90
-
SHA1
4dc80e230c6f38acae85628d913e792daa12ddab
-
SHA256
183281b306d4d06b0bd3e8805a60fd2db9ab8f743d47cb29beb56694614f7270
-
SHA512
7b0b033f63d7aa635779093fa3a2991d783dab29f4037552981309045cfc251cb2fc71bec8d99852e7762282d492bf4198287c1efc86833ea16270824984fc77
-
SSDEEP
6144:tWInt4heqUOF96tvcMWGXONceGBIucsLN:t/qUOFst4GXwGBIucsLN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\183281b306d4d06b0bd3e8805a60fd2db9ab8f743d47cb29beb56694614f7270N.exe"C:\Users\Admin\AppData\Local\Temp\183281b306d4d06b0bd3e8805a60fd2db9ab8f743d47cb29beb56694614f7270N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rs.exeC:\Users\Admin\AppData\Local\Temp\rs.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\orau.exeC:\Users\Admin\AppData\Roaming\orau.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\wtssvit.exe"C:\Windows\system32\wtssvit.exe" /no_ads2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
174B
MD57cb1d30549e1e9bffb229f42effdd864
SHA1ca5e206098f88d2d6c453a46a25b6fc142d27dad
SHA256b8fa1fc7ad5f3c21e017fb569bc6c7724f5fc8e0d5508b012551c2a79de2ecef
SHA512657d9716f3dd71de70fd958776dc0b8c9dd873483d6a32532d0b1966a35a53f5cffc90f3487ef73e3ba0683b62ee0612e6bf6e865b2a5da1e51eb0ef5970d837
-
Filesize
170B
MD51cae5f991b79718364bd3af873e5feca
SHA1e028d75002a820c0dab6b5ce05f0b2990fab9bdd
SHA256f6ea5fe6750a3bb97c5cf90c85fec9f9cc564626b72f767801f22f1984d44a10
SHA512b6c01364c6fd38473984c3eaf3826954061493d69743746002588c3bc496c4784e00e659ac604ad0ecd672cb5de01d4406155fa5f3f2438a1ae37d4dd671c415
-
Filesize
74KB
MD5a06938dc128be2c105246e7c5dc5ddfb
SHA1de1af16987f6556fb42790fb690f78b41f4133c7
SHA256ce6a8a2accac99a44fa9827dac675a364d7d40019e57ba1d11140668a5121543
SHA51249f64b01496d6af93e888ee8cc2747253a69de0fa1f5dc5d19705e8271c6bfbd182b806ec4a84d612d6505ff9e897bf9f37d5b8e7e5c4b394047efd365b9db78
-
Filesize
660KB
MD5df525b239ad7267ff963d6a9ffa18b91
SHA12d8bf933a18ef4c0595885a2c3a67a15d693bdd8
SHA256a79ffa90bfe4592bce7af4af9a3399f355c3ccb7ed8c28f5840e2ac01d3125ef
SHA5127dce620200f2ca70f6af9fc8afa4136b0fe4714c443677ac187b162568fb1bc10c772bd24681a18099e827b80fe5ed95f468cfbb53f95b038e65017e18428993
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
196KB