Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe
Resource
win10v2004-20241007-en
General
-
Target
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe
-
Size
4.5MB
-
MD5
fa31a70b20d5d1666ddd40cf3305e334
-
SHA1
530a9bc75d351810f8e4690a7041339ce255bbe0
-
SHA256
b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94
-
SHA512
5cfe701112133127ac73a302ac9a1ce3f1f6da42d60fffed1007f9931cb47bcd6d0d5557a25faaecf1c692d1f70916cc6c1136619703f9c71c171663377b9fa0
-
SSDEEP
49152:1z6XIrSYssIOfbCcWYLdNBpQkdmTlrg12d8xfMHFnJgxy5CVB0cEWxPZ/xHdbrsi:1+Pc2Q2d6Ml6xBB0nWxPZDuJWP
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe -
Executes dropped EXE 1 IoCs
pid Process 464 tomemb.exe -
Loads dropped DLL 1 IoCs
pid Process 464 tomemb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tomemb = "C:\\Users\\Public\\Documents\\tomemb.exe" tomemb.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\W: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 464 set thread context of 4676 464 tomemb.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tomemb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe 4676 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 4676 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3996 wrote to memory of 792 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 10 PID 3996 wrote to memory of 792 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 10 PID 3996 wrote to memory of 464 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 91 PID 3996 wrote to memory of 464 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 91 PID 3996 wrote to memory of 464 3996 b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe 91 PID 464 wrote to memory of 4676 464 tomemb.exe 95 PID 464 wrote to memory of 4676 464 tomemb.exe 95 PID 464 wrote to memory of 4676 464 tomemb.exe 95 PID 464 wrote to memory of 4676 464 tomemb.exe 95
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe"C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Public\Music\tomemb.exe"C:\Users\Public\Music\tomemb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD51273d6d6be7ef615d07ece772e1db9d1
SHA14936d2d7c7d9e44837a341289aecfa785b541aac
SHA2563a0673e15e7c6b19c989105077e49fe73483ab180f55138b86baa05b9598da3c
SHA5122d61ae001d6acdc48ce4e6bedb4007a8650fd1cc09aba76f5ca9badddbc622aa656cba2e4d789d32e126ec152e3010efbf7c4a8dd4ab5a62c471f1f03e6fa28e
-
Filesize
116KB
MD5a58593c975d020cbcad9f06d87f80444
SHA1d3e206bbb811ee0ddb62fe9459a042fa4c344a01
SHA256b5579f9e315cc2cfda4e0a337d42f03e31f5963abe1b274f2f857e44131386c0
SHA512066f195e15a608ad1c9ec2c85a0d6d6e1964b09e8fb8932db79adcc74d2f041110823d16b4f8991f000463e484ddb76e92515bcdd8e4064f8112cfdf8e157a8c
-
Filesize
243KB
MD5c6a9fb54e338765cfb396ac72801bd56
SHA107b0329d2a82c38d67a7ddcca8612dcb41f1dc1d
SHA256ce383621cbbdc57b24515b312517e294ee38bb48fd405710228843cdbe445056
SHA512ae640c97b4da26fe9418f48bf6da4c9f470a9ad24d0809dfc3e3b18a81ec63e9b7ee79a8f9e5640a7aa91a42a6fdfc48520cd25de8eb2d3fbd3bc9e93b8f5468