Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 14:29
Behavioral task
behavioral1
Sample
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe
Resource
win7-20240903-en
General
-
Target
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe
-
Size
159KB
-
MD5
3a746d12104aa8da6a56bc39bfbf9400
-
SHA1
6e923f8079882c319188440a10bfd1b77d2b15d4
-
SHA256
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85
-
SHA512
349a972eb610164060d4671a2f6197dbea59d5355c96c7c3760eef147d88bc2fb6b5f10954d2ad9cb98a8da38e2b2e083fbe22daabbe5391c767bb403da0e398
-
SSDEEP
3072:yp56zRJ83+OJ7NoGvdwWy6k04yW/KR0Yi:yOzRWu27dlOd5/Yi
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 3484 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exedescription pid process target process PID 1396 wrote to memory of 3484 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1396 wrote to memory of 3484 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1396 wrote to memory of 3484 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1396 wrote to memory of 3976 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe PID 1396 wrote to memory of 3976 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe PID 1396 wrote to memory of 3976 1396 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe"C:\Users\Admin\AppData\Local\Temp\0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:3976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD5629952881d91234b5ebb3b3a780fd8f9
SHA1fcdc06382f58372353fd9f045cb7f6aa0100def9
SHA256a02a6b9a7d22f46eb42ad2c0d18df257f29ca24ad26058e7f12addaf44ad0ad4
SHA5126ffa7c01cd1b3f7eab560a838f4b9063d469ad90303afc010a6001bc983c77a94b43ddc4e2f1559f23e050be6d9ecd49fc11888c9be83351d2818fb5618cba9d
-
Filesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
Filesize
340B
MD5809642777c7cdfbb0dd067abefc87083
SHA10f6cf2cbc0d15360a5db30d362c124f255e53e6f
SHA2564a53c8eadfbed7dd4c5caafa52c9b4fa6dcbe86cd3144649d2e7cebadf8b3939
SHA51295ddbded3f32c4a7f8e97f9a3c65425e30b4c056ef1ff97825f5b634b3a7c47d50aa53e1a63fcdcf3e8c3cbacced4fd1862537202faeb7db1fb8e86901a94335