0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948

Analysis

max time kernel
94s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe
Size

41KB
MD5

75e8124f92b36620ca8db34819a49500
SHA1

cd6c614da333e4250769fae47560d9f1dc5b154d
SHA256

0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948
SHA512

69b9582cab22611ecc2f68e2560e27ed3e6f8fc9bd192b52b1744500b295154b5a2838ebead0a478b256eed1bbb041ea103e7bc2d4edc3fdfd0ec50ded094139
SSDEEP

768:Q8e/H+9lFh0ul16sh7iQroCH+f+RjFBSuB2Xaj:Q9f+Z16sh7iQroCpRB0u3

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe

Executes dropped EXE 1 IoCs

pid	Process
864	bkgrnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bkgrnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 864	2792	0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe	82
PID 2792 wrote to memory of 864	2792	0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe	82
PID 2792 wrote to memory of 864	2792	0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe	82

C:\Users\Admin\AppData\Local\Temp\0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe
"C:\Users\Admin\AppData\Local\Temp\0d9b33415c51a1661655e1376e906643ee2429248c53209a6ed15be2aa5a3948N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe
  "C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bkgrnd.exe

Filesize
41KB

MD5
8afe5b6146020674cb5f3f65fa6d0b7b

SHA1
45469cac5c93c9a7cb3dfa1e7cde810db71b33e1

SHA256
512ae48e7799e2d7779de1e97ab29d2e037e83a5d1b66a732deab75da8920503

SHA512
43b4417f77aef4955dfdac8d840654c08eab06a7ef1bf7d69107c5c0e9f6f482958028b0c802d9f120a8df74999750e6479e2004c405c74a3543f3240b70b64a

Download Submit
memory/864-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2792-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2792-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2792-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2792-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download