797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157

General

Target

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe
Size

282KB
MD5

40ee20062ea7c34b5f2d6ad500e6f710
SHA1

0f6b3a858bc89be0b4fedd133266793576f418e7
SHA256

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157
SHA512

8b5b81291650218adbd7165a3fe6753ba865c0b6b2f13f6bf700bc87c6b3915ea94afbdc77a5bc447149c2dff88769725b878710b9efe1655b6a59a825ddd391
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfpG:boSeGUA5YZazpXUmZhZ6St

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe

Executes dropped EXE 1 IoCs

Processes:

a1punf5t2of.exe

pid	Process
436	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exea1punf5t2of.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exea1punf5t2of.exe

description	pid	Process	procid_target
PID 4624 wrote to memory of 436	4624	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe	86
PID 4624 wrote to memory of 436	4624	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe	86
PID 4624 wrote to memory of 436	4624	797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe	86
PID 436 wrote to memory of 2156	436	a1punf5t2of.exe	87
PID 436 wrote to memory of 2156	436	a1punf5t2of.exe	87
PID 436 wrote to memory of 2156	436	a1punf5t2of.exe	87

C:\Users\Admin\AppData\Local\Temp\797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe
"C:\Users\Admin\AppData\Local\Temp\797b0eea8f8600968dad3e17f112d28e7f5668e3f883e10796d76ecbc36b5157N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
282KB

MD5
60bb42fc3f6f05730cabccf9b082fb23

SHA1
9022fd88231d9541bf3d28801235968616f708f2

SHA256
7bb13eff90ae2f34c7e042e7bd7c88114397996a49ba977c8bf65cf3cd9c3188

SHA512
b84f9ee20aa248f7ec297cf0aad9325bcaf3fba358ee82c8fab5999c3ed049e8fb9f0c4806b31a67de48de1d2219ae731c455c4836cc8142616277d35de1e932

Download Submit
memory/436-24-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/436-23-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/436-28-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/436-26-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/436-25-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/436-21-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-5-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-22-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-7-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-2-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-6-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-0-0x0000000074F62000-0x0000000074F63000-memory.dmp

Filesize
4KB

Download
memory/4624-1-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/4624-4-0x0000000074F62000-0x0000000074F63000-memory.dmp

Filesize
4KB

Download
memory/4624-3-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads