Analysis
- max time kernel
119s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 00:35
Behavioral task
behavioral1
Sample
46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
120 seconds
General
- Target 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe
- Size 371KB
- Sample241004-axm5navdrr
- SHA256 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554
- MD5 daba502d270d8c7970e6413e70ad64f0
- SHA1 64c12ff1354120dff0c71955d7639167941cd06a
- SHA512 a33791bb0d18cda7b3591b5f2088ed2f7f1c6f72d28cbf7ac34a49d60b4363f8f5866297c0a30616f74c6ccb256f98d88a97f4178d7a2387d8a3ccaecd94f2cf
- SSDEEP 6144:CuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62pl1:CzGL2C2aZ2/F1WHHUaveOHjT/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation fybua.exe - Executes dropped EXE 2 IoCs
pid Process 4040 fybua.exe 848 rooqs.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fybua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rooqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe 848 rooqs.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4040 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 82 PID 2672 wrote to memory of 4040 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 82 PID 2672 wrote to memory of 4040 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 82 PID 2672 wrote to memory of 2072 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 83 PID 2672 wrote to memory of 2072 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 83 PID 2672 wrote to memory of 2072 2672 46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe 83 PID 4040 wrote to memory of 848 4040 fybua.exe 94 PID 4040 wrote to memory of 848 4040 fybua.exe 94 PID 4040 wrote to memory of 848 4040 fybua.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe"C:\Users\Admin\AppData\Local\Temp\46b06d0169d9e4331fac4aa4bcc0af6b359f7c7cb287bf26af4744705eca7554N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\fybua.exe"C:\Users\Admin\AppData\Local\Temp\fybua.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\rooqs.exe"C:\Users\Admin\AppData\Local\Temp\rooqs.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
- Size 342B
- SHA256 42542ad4667a0e43dff5283567dad6e8a2995366ba7547c822e5734fcd782100
- MD5 fed8c560b73e9461d78fc6e623425571
- SHA1 93569ed3aed6cd3c92d4ee8d8b799110f408298a
- SHA512 8a1077eaf322748550ab7ce22431c00b011858bdac085de84b9843b4e2efad4517bffa249f1115acff7a51c0e76e43972e73c9335679d8e5bce04af695b06310
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\fybua.exe
- Size 371KB
- SHA256 59d39a8ff1df9e11f446d9c2fc7b2399de61864a08c52aa001aa80b4078ee2b2
- MD5 56d63bcc2a041e5a74c424dbd5deb13e
- SHA1 9058d37d5c5890ef9e66ffede0d41d55c2a75210
- SHA512 298f24f2e0e43036e6491ddd9dcafdfd967a0e9b71183d3613d08df5d7bb2b3345fae45abf85fcc3e5a51400d6fe43e7c8ad7a65c679656ee7f9910468ce1f80
- SSDEEP 6144:CuJkl8DV12C28tLN2/FkCOfHVm0fMaHftvCGCBhDOHjTPmXHk62plS:CzGL2C2aZ2/F1WHHUaveOHjTc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
- Size 512B
- SHA256 7c15e3ac6ee2ce679e2ab459158cf276e9a4566a061cf0fbfd0e944c75e3babc
- MD5 e7a9c0974dbf12ca9b0f38b9cefcbf6a
- SHA1 87ca145c26df33622eb8e11bf32f9554bc2c4761
- SHA512 90032b225adac7af574a1b7933d4c69bab2b1989fbaaf1afdab3474eaf43420db606a4d16c54236248b21d6f6fda2321f858120a502a4671259bab195700ad53
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\rooqs.exe
- Size 303KB
- SHA256 f8da5e05d3fcded47816453a4dbbd57a612b8658540b6b427d3dcd0498fd37bb
- MD5 5f6686ac7577f0329e51d8a547694303
- SHA1 e8dd1a6add7452719952ff7661e377dc440f6902
- SHA512 f6315108b133ac3d787c28926cc030a6c1ed35e36eaa791d9d386ac7255f277c4c6224c1f773ab0b271a096ff848959a95949b5861859c0314f222e13f2b68fc
- SSDEEP 6144:ddI/RDUXW62fs1FbIbrvBcVPH0T5J5ZtmOZpc:XI/RDUm/S5IH57/oj
- MD5 SHA1 SHA512 SSDEEP