Analysis
- max time kernel
119s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2024, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
- Target 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe
- Size 132KB
- Sample241107-nsvktstphn
- SHA256 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840
- MD5 eb2ab4c4cba17142738ac70375a65e50
- SHA1 5408e57d2c84ef30fa5122dc855c4184fafbc51d
- SHA512 2dbea400ee5c91703f0ae90b7a9f6d4065691bf292d32b698c5e0666d0d4da0eedace5184984260d8c5a840a367281bccbc29af96bac4ce45ffdbf91c2875fc9
- SSDEEP 1536:bHFjwOqUuflO+6peVdM/d2yv6n0APB8qFE0OSqHW2PYoPPrCLaC46lxIDCwMZODP:ryOqxY+6pejzNB8A4xAo784KmMMDLHb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe - Executes dropped EXE 2 IoCs
pid Process 2168 indiagamcaa.exe 2368 indiagamcaa.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\indiagamcaaa = "C:\\Users\\Admin\\AppData\\Roaming\\india gamcaa\\indiagamcaa.exe" reg.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4208 set thread context of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 2168 set thread context of 2368 2168 indiagamcaa.exe 101 PID 2168 set thread context of 0 2168 indiagamcaa.exe -
resource yara_rule behavioral2/memory/1984-3-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1984-5-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1984-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1984-41-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2368-44-0x0000000000400000-0x000000000040B000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indiagamcaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indiagamcaa.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe Token: SeDebugPrivilege 2368 indiagamcaa.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 2168 indiagamcaa.exe 2368 indiagamcaa.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 4208 wrote to memory of 1984 4208 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 92 PID 1984 wrote to memory of 3868 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 93 PID 1984 wrote to memory of 3868 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 93 PID 1984 wrote to memory of 3868 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 93 PID 3868 wrote to memory of 3624 3868 cmd.exe 97 PID 3868 wrote to memory of 3624 3868 cmd.exe 97 PID 3868 wrote to memory of 3624 3868 cmd.exe 97 PID 1984 wrote to memory of 2168 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 98 PID 1984 wrote to memory of 2168 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 98 PID 1984 wrote to memory of 2168 1984 528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe 98 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101 PID 2168 wrote to memory of 2368 2168 indiagamcaa.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe"C:\Users\Admin\AppData\Local\Temp\528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe"C:\Users\Admin\AppData\Local\Temp\528043dff4c06d5409423beec1a7af3355c5011de6b0f6a4106bd359d28ae840N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CWUSX.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "indiagamcaaa" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3624
-
-
-
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CWUSX.txt
- Size 158B
- SHA256 597efbff7588882d8866604df4e7a4f715418a7d9bae4736029412fda3bfa455
- MD5 033ff48e13742ca54269e0846484b830
- SHA1 082ce1eed215dda59ea75a8227f8cd0e1b15d36f
- SHA512 8727692731b3788a5f8a5b5d4e79f009a8953d9a236f66e4cdc963c82c9aff3b6e833a491f78f88d55d8bad4d46f5d81e279974600ddbe5ea2c42003f043adda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe
- Size 132KB
- SHA256 e33877a45d076c1294d33f951866487e354163b5492d43c8054b371f586fab3f
- MD5 d6534daf41761a5ddc4425f6920608d1
- SHA1 543ffbdcc753aa22a5725d295e6682ee4da3ffce
- SHA512 0eee0ec0349c27c419e4ee9c39ba6ffc89eda88df4fa1c293119786dc6a90388d831c51f2782d4da950c490088a7f7b1c94555ffd29b0e180cb9715d1b78dc88
- SSDEEP 1536:bHFjwOqUuflO+6peVdM/d2yv6n0APB8qFE0OSqHW2PYoPPrCLaC46lxIDCwMZOD9:ryOqxY+6pejzNB8A4xAo784KmMMDLHJ
- MD5 SHA1 SHA512 SSDEEP