Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
IPRadar.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
IPRadar.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
xiprad.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
xiprad.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
xutil.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
xutil.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
IPRadar.exe
-
Size
872KB
-
MD5
8d984c91b9a51fdd476c189214943aa3
-
SHA1
6d7bf92c0513ac017c5a5ad71d11852092639bfc
-
SHA256
afa31c0835ba42c1950d62cd84dad05f5a2586364e2dc4b8405a571cb6e5d10e
-
SHA512
47d2b97653b7acef05694a52d27524ed0b765a20ba3814e3abe1bcc38f3c2209ce4c313708d72270d0cd1563f99b5c929fbd7501ea3957420e73908a17f90d83
-
SSDEEP
24576:Hy/E8Cx5Ko7i7iPyt15iBkCABeSS9QF8KV3GcIAF:Hy/bCx5Kom2a
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation IPRadar.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: IPRadar.exe File opened (read-only) \??\F: IPRadar.exe File opened (read-only) \??\I: IPRadar.exe File opened (read-only) \??\M: IPRadar.exe File opened (read-only) \??\Z: IPRadar.exe File opened (read-only) \??\Y: IPRadar.exe File opened (read-only) \??\L: IPRadar.exe File opened (read-only) \??\P: IPRadar.exe File opened (read-only) \??\Q: IPRadar.exe File opened (read-only) \??\T: IPRadar.exe File opened (read-only) \??\V: IPRadar.exe File opened (read-only) \??\J: IPRadar.exe File opened (read-only) \??\K: IPRadar.exe File opened (read-only) \??\O: IPRadar.exe File opened (read-only) \??\U: IPRadar.exe File opened (read-only) \??\W: IPRadar.exe File opened (read-only) \??\S: IPRadar.exe File opened (read-only) \??\X: IPRadar.exe File opened (read-only) \??\D: IPRadar.exe File opened (read-only) \??\G: IPRadar.exe File opened (read-only) \??\H: IPRadar.exe File opened (read-only) \??\N: IPRadar.exe File opened (read-only) \??\R: IPRadar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPRadar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPRadar.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 IPRadar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz IPRadar.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2452 IPRadar.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2452 IPRadar.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2452 IPRadar.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2452 IPRadar.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1804 IPRadar.exe 2452 IPRadar.exe 2452 IPRadar.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2452 1804 IPRadar.exe 84 PID 1804 wrote to memory of 2452 1804 IPRadar.exe 84 PID 1804 wrote to memory of 2452 1804 IPRadar.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\IPRadar.exe"C:\Users\Admin\AppData\Local\Temp\IPRadar.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\IPRadar.exe"C:\Users\Admin\AppData\Local\Temp\IPRadar.exe" -shell2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD53f7fcb7e053d2a5faf0ed0a450e5a616
SHA18bfe25df6be941d30dbd8d86509fe37b13597b33
SHA256dec03f01bb431b9f6a41d840246949339af8900eb101552927815d1a26f21502
SHA5120b389419cae1e0949e93fd06476824740cbfdcb5193df2eb87b42f0c2b28dec62fd0ee72c0e034a15c6632845efd91022020adad9b1632b902036fdecc50c6a5