4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PL/setup331.exe
Size

2.0MB
MD5

2486b7f5f41d592ec4781b54cd828f70
SHA1

604009984d2f335a969ab447a61beec8661a99fe
SHA256

aa0a01e35fe2110068e1934eb568f5d3a41abe4b73a64a045f9a9ab8e085114c
SHA512

116cee6490ae2b631b0457c0ae328f88df74bff3b8f2b47652366cf125d22fc910733859825ed181ae547a664c15e5358c95cdd6b874c43cc426303bfd841370
SSDEEP

49152:3rBfJXAEYCT6v3vX/1AkJxopk7lDiQCv3e6rNx:3rBfKEYd3v+Ioi7Rg5x

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup331.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	setup331.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2392 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2392	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

setup331.exeregsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup331.exe

description	pid	process	target process
PID 4072 wrote to memory of 2392	4072	setup331.exe	regsvr32.exe
PID 4072 wrote to memory of 2392	4072	setup331.exe	regsvr32.exe
PID 4072 wrote to memory of 2392	4072	setup331.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe
"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s MYQXM.k
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MYQXM.k

Filesize
1.8MB

MD5
942afe4b6c981193fda8ede7a57fd5bb

SHA1
62e6bb30e5a02920a3bbb1dffa7bd90d699afcd6

SHA256
99128a36e75d6739f15b1c5e8b40b5afe57740e6bf3d573c8636b26f78b2fb88

SHA512
2089221b9d554e51b016415b7e07c65ee0d76b1d3136a9424a98212ca812cb8d263d716d79cc4addca40f2c67df25ad642dfa903b6a641afba219bd9fc797955

Download Submit
memory/2392-4-0x0000000002FF0000-0x000000000311E000-memory.dmp

Filesize
1.2MB

Download
memory/2392-5-0x0000000003250000-0x0000000003379000-memory.dmp

Filesize
1.2MB

Download
memory/2392-6-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/2392-7-0x0000000002FF0000-0x000000000311E000-memory.dmp

Filesize
1.2MB

Download
memory/2392-8-0x0000000003390000-0x000000000344D000-memory.dmp

Filesize
756KB

Download
memory/2392-9-0x0000000003460000-0x0000000003509000-memory.dmp

Filesize
676KB

Download
memory/2392-12-0x0000000003460000-0x0000000003509000-memory.dmp

Filesize
676KB

Download
memory/2392-11-0x0000000003460000-0x0000000003509000-memory.dmp

Filesize
676KB

Download
memory/2392-13-0x0000000003460000-0x0000000003509000-memory.dmp

Filesize
676KB

Download
memory/2392-15-0x0000000005400000-0x00000000054A2000-memory.dmp

Filesize
648KB

Download
memory/2392-14-0x0000000003510000-0x00000000053FF000-memory.dmp

Filesize
30.9MB

Download
memory/2392-16-0x00000000054C0000-0x000000000555C000-memory.dmp

Filesize
624KB

Download
memory/2392-19-0x00000000054C0000-0x000000000555C000-memory.dmp

Filesize
624KB

Download
memory/2392-20-0x00000000054C0000-0x000000000555C000-memory.dmp

Filesize
624KB

Download
memory/2392-21-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2392-23-0x0000000000B70000-0x0000000000B74000-memory.dmp

Filesize
16KB

Download
memory/2392-29-0x0000000003250000-0x0000000003379000-memory.dmp

Filesize
1.2MB

Download