Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
Resource
win7-20240708-en
General
-
Target
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
-
Size
64KB
-
MD5
5b3681183fcac84310c399ddf00064f0
-
SHA1
f4e9b64b88aece299daff568a1c00d8d4404d7af
-
SHA256
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2
-
SHA512
160cfb001d94e566005487236d8455d5a2b5f48e892e97dc8cc8c44f6a009ed7d0739c9d68f5dd3bb3e72ee28ea74bb62d1e200ed9e158a744f1ced82f1feda6
-
SSDEEP
1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/o:6bQRSHpAvzyf7MzeTYo
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2868 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exedescription pid process target process PID 4624 wrote to memory of 2868 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 4624 wrote to memory of 2868 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 4624 wrote to memory of 2868 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 4624 wrote to memory of 788 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 4624 wrote to memory of 788 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 4624 wrote to memory of 788 4624 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ba3d1928e8e5ce6b32367aa65fa19036
SHA10563de0c7c546cf5384f802cde98c42fde12d521
SHA2560056215373ba8f7413f065cb7c9158dbe08e5bd5c6b4e8c8e763fcd3fff2c4cb
SHA512e4b52506d6212805be8af805927d98020b77216e6f87c813e6266e23777f2b8c542ba216f328a624b21fc9cbcf690e7614f8b6fe3e6de20fa91a0f8eb3a7fed6
-
Filesize
512B
MD5efd90b3ac908d5482af367de3a82184a
SHA1de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA25644f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
SHA5126e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
-
Filesize
340B
MD552de364334f68538894034967dfa7b25
SHA1d394b860ff927b3ea1504d8bbf73aaa61a450895
SHA25632c8eaa5d1514a1b8920543cbb2e86686812ef8d678ab6a092686398679beb01
SHA51245aeecea873ce57713bc49e65fb398f90a725ad1210e9b31feee0debe6a9df31c9c7345f1f5546b56cfa52c6ed1de0542ebf405aa0352ebed302bbc3b1407de5