e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06

Analysis

max time kernel
132s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
Size

134KB
MD5

b9d456f72aa9fddb7410de3b686aefe1
SHA1

8c461b35647a0c57134ec694eed4338e1d5dba27
SHA256

e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06
SHA512

59b2b42e5c6064a9d82111151f0717fd114b79758889c402ba975a9d251a9e8d7ea2099f6448e2e5330333bc77a8e8c358cccf2a6456a5ba2ce624e4ddfd4623
SSDEEP

1536:New08ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2AjpH/e3msYpKZZkUR0:Y0uk8QsH47nW5ppfe3msYpKZZQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe

Executes dropped EXE 1 IoCs

pid	Process
4128	huter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4128	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	89
PID 1740 wrote to memory of 4128	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	89
PID 1740 wrote to memory of 4128	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	89
PID 1740 wrote to memory of 1788	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	90
PID 1740 wrote to memory of 1788	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	90
PID 1740 wrote to memory of 1788	1740	e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe	90

C:\Users\Admin\AppData\Local\Temp\e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe
"C:\Users\Admin\AppData\Local\Temp\e2e2ba4cec2ccf5bc33ec28eee08535278ac986032e0befe24ef56038e25da06.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
a01dba4c45102fc15292fd5591166536

SHA1
d96191c30e0f09439d8547f4ededbf6726ccd54b

SHA256
cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904

SHA512
277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\huter.exe

Filesize
134KB

MD5
04209b7dfee2d72303a64fa201f48334

SHA1
50a9e4ef375f5c70ee2ccda562aa624abda49192

SHA256
ea34d8b64ca0341ee2f9709e61122b6cf3a20ad4e26f8519f13830175fcebb3e

SHA512
20ad1a53ddee6753f3ceeed1e9e717fd984b1509125dbfa44c1d8e9111609920b7e15ddab06d13cb18a1b956fca7ec9ea817b34cd322fdfacba1e4304e38059a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c0599fdef20a6ccf72f32fcc9a3760f4

SHA1
a50c8735227921e29a37d57f5d0893e44cc1b8d8

SHA256
6839397c83735603b8bba34beb2d48273813862b528ad35a3e0f0bcfa04d7210

SHA512
25042ed5a007ebc4d4e94688ad10e6e37aae20df3d9eb149974d61feb26461c929021cd7c7e9128603b730b911ad0f2643727af8641f770c06f6c14837b7ebd9

Download Submit