Analysis
- max time kernel
118s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
- Target 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe
- Size 88KB
- Sample241107-reda6swlek
- SHA256 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56
- MD5 bd6a254eb9a31785daeb18f4b9b8b730
- SHA1 875b9519107984a21d3a2cf6f4a5b3384d7587a0
- SHA512 38a69119c8aa5243a1dea32848cd02a108943c267e3bd895f26cefc28f41aeb60da04d60ca35291e94b19ada5d4bfffa1a0f30bbd6e0c1ae32cc440f6d82d87a
- SSDEEP 768:aQNIscPXcOAKrm//4SE6rdcIz0M6mc39vAqBbXml/X4B0blMTIWo90UvIC2TVGpC:aCILvs9NctvAqlWpoBjpUv72TDFP
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation configs.exe - Executes dropped EXE 4 IoCs
pid Process 1628 configs.exe 3844 configs.exe 1464 configs.exe 3676 configs.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio Driver = "C:\\Users\\Admin\\AppData\\Roaming\\system\\configs.exe" reg.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2612 set thread context of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 1628 set thread context of 3844 1628 configs.exe 104 PID 1628 set thread context of 1464 1628 configs.exe 105 PID 1464 set thread context of 3676 1464 configs.exe 106 -
resource yara_rule behavioral2/memory/4100-5-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3844-85-0x0000000000400000-0x000000000040B000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language configs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language configs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language configs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language configs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe Token: SeDebugPrivilege 3844 configs.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 1628 configs.exe 3844 configs.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 2612 wrote to memory of 4100 2612 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 93 PID 4100 wrote to memory of 5064 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 98 PID 4100 wrote to memory of 5064 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 98 PID 4100 wrote to memory of 5064 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 98 PID 5064 wrote to memory of 2296 5064 cmd.exe 102 PID 5064 wrote to memory of 2296 5064 cmd.exe 102 PID 5064 wrote to memory of 2296 5064 cmd.exe 102 PID 4100 wrote to memory of 1628 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 103 PID 4100 wrote to memory of 1628 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 103 PID 4100 wrote to memory of 1628 4100 30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe 103 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 3844 1628 configs.exe 104 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1628 wrote to memory of 1464 1628 configs.exe 105 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106 PID 1464 wrote to memory of 3676 1464 configs.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe"C:\Users\Admin\AppData\Local\Temp\30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe"C:\Users\Admin\AppData\Local\Temp\30a831d66ff2034ceba7d20b70cee41f21ccd575cb8ebf86747194fda1163e56N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OKJXE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Audio Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\configs.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2296
-
-
-
C:\Users\Admin\AppData\Roaming\system\configs.exe"C:\Users\Admin\AppData\Roaming\system\configs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Roaming\system\configs.exe"C:\Users\Admin\AppData\Roaming\system\configs.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3844
-
-
C:\Users\Admin\AppData\Roaming\system\configs.exe"C:\Users\Admin\AppData\Roaming\system\configs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Roaming\system\configs.exe"C:\Users\Admin\AppData\Roaming\system\configs.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\cxz.exe
- Size 306B
- SHA256 583d77b4076c6d0f838884523327720c4d1cf37fce74032c2251e12fd0017466
- MD5 cb71b8be236ae0370b727b8517208d30
- SHA1 8c4e22571d4b94a9b1b3cf397e076fff9f2aa27a
- SHA512 69656a63aca999c5b8d341f8245fd39eccc198ddbe9172b4b0805495c76a4ad84fc9f8d7f6c76641219d59863096a6e39215d6bd04dd6486fcbee4d551d91162
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\OKJXE.txt
- Size 148B
- SHA256 958d6eb1237dfb77692e9b712b51ef05d6ac21bddfd8e7d7d9a2dbe71a975179
- MD5 c85bfe60cc1236f9ccf153a142bab133
- SHA1 5d73ae02ea3ed5f99dfd2bbba218d6f0b1d2972b
- SHA512 f5f8401b8ed5451497ec32525c299db94072be79af44c4384d006dc5acedceb779b07a0f6e9e8db74d475761190636403cb5ffd90cd5ca4a68ccf967a4a79b88
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\system\configs.exe
- Size 88KB
- SHA256 5f93aaae0092ae7a7e01daeda9e0dfc60e0f47bbeb535c41906b471828efab94
- MD5 49d91b88e220e954f4865cf23f24fe98
- SHA1 8e42b628dd2eacbf3c554c070a22453e3991bbef
- SHA512 48913a119eeaf309b8f84d979b06d1078f5b8e5a8b9375beb81e4c283f3c7daefb0ad63f3becd3bd2f9a9888ce13916a8d49cfbd164b28e22a7d8f2d7c907eac
- SSDEEP 768:aQNIscPXcOAKrm//4SE6rdcIz0M6mc39vAqBbXml/X4B0blMTIWo90UvIC2TVGpC:aCILvs9NctvAqlWpoBjpUv72TDFP
- MD5 SHA1 SHA512 SSDEEP