Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
Resource
win10v2004-20241007-en
General
-
Target
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
-
Size
46KB
-
MD5
9e1fa03549ebc332a67dcb7ec74ed050
-
SHA1
53deae8f6edc1543f573fb0fbc25dd66bb2739a2
-
SHA256
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303
-
SHA512
3207f608310e37bae8ba3bcbb18c2e8c4ce02049fef68ac63bcd555ed21ebad7dc5983b24770bb0246fc6e7be7a66896cc2102158a2a11ccb5d431fbac20c53b
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zO0:bF/y2lFizbR9XwzP
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe -
Executes dropped EXE 1 IoCs
pid Process 5064 rewok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 5064 2672 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 85 PID 2672 wrote to memory of 5064 2672 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 85 PID 2672 wrote to memory of 5064 2672 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe"C:\Users\Admin\AppData\Local\Temp\ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD535f71eebc7edb4fa8191a60ad08459d8
SHA19df8fe22dce0444febe9f1c2184bb06dbbde3df2
SHA256e46324d308d73c7925ee51a5932d735801c317809b8db8fcb6cd8bd2fd7e8e45
SHA512f22af04826da8c63460b8b645432af7feebb6617849d74c55facb2f77b0a7d08230882481e09ac6d9677a71229b97a5b1302e4dce1c9f7164db60fb39b1baf37