Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe
Resource
win7-20240708-en
General
-
Target
df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe
-
Size
67KB
-
MD5
20fa9fe9bd77569db6756eb0666c7460
-
SHA1
5324425f6f6ec6d93b7660a1499f2d1085aa0129
-
SHA256
df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1
-
SHA512
58d86059a581e69815b4fa63b67c7ce5b1a15e02039071539abbd4b02d60255d8ac1874e294a18565190cfb4bd50eaf19b4aefedb47dd1e28d910601845bf322
-
SSDEEP
1536:v6fqsAPQYGmPzmZDDZrV8sMQXGkfn33n7z5WeIuhCarec:yLAYUzmdD0sMQl7d7IuhCaic
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe -
Executes dropped EXE 1 IoCs
pid Process 5084 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 936 wrote to memory of 5084 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 87 PID 936 wrote to memory of 5084 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 87 PID 936 wrote to memory of 5084 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 87 PID 936 wrote to memory of 376 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 88 PID 936 wrote to memory of 376 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 88 PID 936 wrote to memory of 376 936 df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe"C:\Users\Admin\AppData\Local\Temp\df5821beb6f7775c2cf90f09411dbf8bc38346f11b118a42a10d31a5d1591ec1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5aa9866ac7a2105bd762f263a1b337186
SHA1e224fc2860c26e2fc111735d2858124d4b2e8f87
SHA256edec23c57a47bf5159041df01c24c841f0f490b2957c0a91bd741373d9649af3
SHA51287d5a0200d115f5626c48b1b9279da43c4c976be6fc6e7c3ed8fbcf8be9b74a3f930eb365633bcb37535109bfbe5c8ec9495b432d89a9a529893a7de8f7495e1
-
Filesize
512B
MD51c9b2720af0ca9528b47898d9c7f4799
SHA180495f16e333f54ecc700252323c2a7cb7d751e1
SHA256d1ea9a17b5a635a121e82e7963d3b134f74050da9debcd40c9622f50c5d38fe5
SHA5125afe876f2cd887458656b1747bce08d03f26ef286bcc83efa93e0111be856d0564bee4d6ef5637c167626bac121f7371b69c7952502d47784ac9ad568bf53eac
-
Filesize
338B
MD52de2a6507b8c279b053fcf5fd2c42989
SHA1422b4b0e2f2235468290e4046e6e535d3d94a1eb
SHA256e3ce7eb08743adade301e52c731aa299a69c575a919d97c6972ec25e421aefa0
SHA512f55f1ce902fac21a9eec3c41a7ea4f7ee42e51aaebb33c3441593c1b58d67ac3a8c0190bc144f3731e1ad06c394da20f6eea7e80b8bcaf57ac1ad524c235a78a