Analysis
-
max time kernel
119s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 03:43
General
-
Target
0c647af7727fa5e18c83f81f598f37d147da5d64130122a744ac83eb908cfb0cN.exe
-
Size
422KB
-
MD5
505c1f8ba132bc782194763100bf1fa0
-
SHA1
933eb9e46a6d7f493ae7c326037f2f7016158f1b
-
SHA256
0c647af7727fa5e18c83f81f598f37d147da5d64130122a744ac83eb908cfb0c
-
SHA512
20e0b70806e3e929f7feab33328725a9baf2362d3f4c67d80284977792f9db350de0e0c864ccef68a2a4f075a96a58240509f5be5a7f9380d47a491b4a6ce1a1
-
SSDEEP
12288:mnRCG8owe1SRHCxH3VrBLfWHoxveTA7za:mnRCG8owe1SRGH3VrBLfWHoxveTA3a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c647af7727fa5e18c83f81f598f37d147da5d64130122a744ac83eb908cfb0cN.exe"C:\Users\Admin\AppData\Local\Temp\0c647af7727fa5e18c83f81f598f37d147da5d64130122a744ac83eb908cfb0cN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sysceamohvsl.exe"C:\Users\Admin\AppData\Local\Temp\Sysceamohvsl.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
422KB
MD5fcb6d30f1c9fa34c04f289df3504164c
SHA1e5cf04d682fb319407e5d0225c65fa1f7bf69362
SHA256802dc0b577ae94e124e679f47f7b5f1cce4b22150ffa05e79508673c99a49df8
SHA512d95dcdbad2309bf66832830ac5452c808536abcc8c67468b768aa632ddf1747b61e0696994eb8b2b0d6ecd9426dbc922c75f38ea1e5c06599456fa3f4d7976e0
-
Filesize
103B
MD597887782b5dfb808f0f51444de5e227e
SHA14266faac20f77e331363978d50706836d5d08055
SHA256fdec3226bc49b1e762b846f90ce0e16f77f11f446cb71fe8ba131dcc998d9d68
SHA5126fadb7d93f8d8fb46d97fe979f5d3ab39d21aab3daf4b41ebcc7f106bf158590857eac057674a193d068b4f3c48f50d20e9bbdfc78cffd1c3f5401c22e71a40d
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB