Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 14:11
Behavioral task
behavioral1
Sample
9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe
-
Size
20KB
-
MD5
79a163b4c81b50be0113f987dd008ff0
-
SHA1
4f85a4e2583dc14f80e3e932511b7d0de9defab8
-
SHA256
9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7
-
SHA512
584dff1cad5b2623695ebdbe7fb3e91360a815100a2dd722c8745d12004c032fa59c2d2f47a8ee87d45a698d485f33d9c080c4d2e18238ab469991fce2bc34f1
-
SSDEEP
192:VjUWFh4fvYGIQnsA6psQXFaNJhLkwcud2DH9VwGfct1hM5EKU:9KE7pXaNJawcudoD7U7S5Ev
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe -
Executes dropped EXE 1 IoCs
pid Process 3840 xplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xplorer = "C:\\Windows\\xplorer\\xplorer.exe" reg.exe -
resource yara_rule behavioral2/memory/1444-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000a000000023b66-16.dat upx behavioral2/memory/1444-26-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3840-28-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xplorer\xplorer.exe 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe File opened for modification C:\Windows\xplorer\xplorer.exe 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe Token: SeDebugPrivilege 3840 xplorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 3840 xplorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1444 wrote to memory of 3496 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 86 PID 1444 wrote to memory of 3496 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 86 PID 1444 wrote to memory of 3496 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 86 PID 3496 wrote to memory of 2824 3496 cmd.exe 89 PID 3496 wrote to memory of 2824 3496 cmd.exe 89 PID 3496 wrote to memory of 2824 3496 cmd.exe 89 PID 1444 wrote to memory of 3840 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 90 PID 1444 wrote to memory of 3840 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 90 PID 1444 wrote to memory of 3840 1444 9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe"C:\Users\Admin\AppData\Local\Temp\9e125c76eaae1f4ea7a95496a6ff650b63e86044ed2a2da0b46515a6547abcb7N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LTKUQ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
C:\Windows\xplorer\xplorer.exe"C:\Windows\xplorer\xplorer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD54e6e99d38b1264af2b53a68c7cd6d648
SHA155ffe17732d1d9c539d702a1311ef9674fe7b3cf
SHA256168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0
SHA512bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d
-
Filesize
20KB
MD5b97e66d94c89fdc6345932ca37017c18
SHA1cb94e9cc43d506b1c8b14e35daca70b8e2a88d35
SHA256b43b1e48307bb53f7da694b85b593c2421b6c6054d4a573ba6e03cdad8b29914
SHA512f66af7aa42b7bdc1a1f9cff688ef315e0d35fc2d68a2a2a9a2b6b3ba23ed328851928684e6ed5c0f359d28162d04dee9e1030d9204460edb5720f81b08b7c3df