Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 08:25

General

  • Target

    b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe

  • Size

    4.5MB

  • MD5

    fa31a70b20d5d1666ddd40cf3305e334

  • SHA1

    530a9bc75d351810f8e4690a7041339ce255bbe0

  • SHA256

    b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94

  • SHA512

    5cfe701112133127ac73a302ac9a1ce3f1f6da42d60fffed1007f9931cb47bcd6d0d5557a25faaecf1c692d1f70916cc6c1136619703f9c71c171663377b9fa0

  • SSDEEP

    49152:1z6XIrSYssIOfbCcWYLdNBpQkdmTlrg12d8xfMHFnJgxy5CVB0cEWxPZ/xHdbrsi:1+Pc2Q2d6Ml6xBB0nWxPZDuJWP

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
      PID:792
    • C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe
      "C:\Users\Admin\AppData\Local\Temp\b2d659ecaaa662f6366cbbef01ea76506632a95d169e6d06dca7fd6452608c94.exe"
      1⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Users\Public\Music\tomemb.exe
        "C:\Users\Public\Music\tomemb.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:464
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:4676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Music\libemb.dll

      Filesize

      576KB

      MD5

      1273d6d6be7ef615d07ece772e1db9d1

      SHA1

      4936d2d7c7d9e44837a341289aecfa785b541aac

      SHA256

      3a0673e15e7c6b19c989105077e49fe73483ab180f55138b86baa05b9598da3c

      SHA512

      2d61ae001d6acdc48ce4e6bedb4007a8650fd1cc09aba76f5ca9badddbc622aa656cba2e4d789d32e126ec152e3010efbf7c4a8dd4ab5a62c471f1f03e6fa28e

    • C:\Users\Public\Music\tom.ox

      Filesize

      116KB

      MD5

      a58593c975d020cbcad9f06d87f80444

      SHA1

      d3e206bbb811ee0ddb62fe9459a042fa4c344a01

      SHA256

      b5579f9e315cc2cfda4e0a337d42f03e31f5963abe1b274f2f857e44131386c0

      SHA512

      066f195e15a608ad1c9ec2c85a0d6d6e1964b09e8fb8932db79adcc74d2f041110823d16b4f8991f000463e484ddb76e92515bcdd8e4064f8112cfdf8e157a8c

    • C:\Users\Public\Music\tomemb.exe

      Filesize

      243KB

      MD5

      c6a9fb54e338765cfb396ac72801bd56

      SHA1

      07b0329d2a82c38d67a7ddcca8612dcb41f1dc1d

      SHA256

      ce383621cbbdc57b24515b312517e294ee38bb48fd405710228843cdbe445056

      SHA512

      ae640c97b4da26fe9418f48bf6da4c9f470a9ad24d0809dfc3e3b18a81ec63e9b7ee79a8f9e5640a7aa91a42a6fdfc48520cd25de8eb2d3fbd3bc9e93b8f5468

    • memory/464-21-0x0000000010000000-0x000000001001B000-memory.dmp

      Filesize

      108KB

    • memory/464-27-0x0000000075AC0000-0x0000000075B54000-memory.dmp

      Filesize

      592KB

    • memory/464-26-0x00000000009A0000-0x00000000009DD000-memory.dmp

      Filesize

      244KB

    • memory/792-28-0x000001C2C9590000-0x000001C2C95B3000-memory.dmp

      Filesize

      140KB

    • memory/792-1-0x000001C2C9590000-0x000001C2C95B3000-memory.dmp

      Filesize

      140KB

    • memory/4676-32-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-34-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-31-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-30-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-25-0x0000000000A90000-0x0000000000A91000-memory.dmp

      Filesize

      4KB

    • memory/4676-33-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-35-0x00000000033B0000-0x00000000033E2000-memory.dmp

      Filesize

      200KB

    • memory/4676-29-0x0000000000E40000-0x0000000000EC1000-memory.dmp

      Filesize

      516KB

    • memory/4676-37-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB

    • memory/4676-36-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB

    • memory/4676-38-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB

    • memory/4676-39-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB

    • memory/4676-40-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB

    • memory/4676-42-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-41-0x0000000000F50000-0x0000000000F72000-memory.dmp

      Filesize

      136KB

    • memory/4676-43-0x0000000003530000-0x0000000003568000-memory.dmp

      Filesize

      224KB