560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
Size 76KB
Sample241109-2a3elstell
SHA256 560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea
MD5 5dd6cf9394bf425eaf924a8ab168b15e
SHA1 5932f89a082a376cf2cd8187d04541dfeb39623f
SHA512 be3d845516a96524a1789cb0048dcf40c7d9c535c164fbcf3bf4c430c739a7ce58b9f9bcf3801608ddc98a1da7cfb23aaec918474007504be3cb6513dd0c62da
SSDEEP 1536:MvP69lUyW1UwzJmWRaD1gXI7uMrpzrnacxfzZ1:G69lU2UmWVXI7uMlzTFz7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
776	svchost.exe
540	svchost.exe
2372	svchost.exe
4532	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Driver = "C:\\Users\\Admin\\AppData\\Roaming\\system\\svchost.exe"	reg.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2844 set thread context of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 776 set thread context of 540	776	svchost.exe	103
PID 776 set thread context of 2372	776	svchost.exe	104
PID 2372 set thread context of 4532	2372	svchost.exe	105

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2672-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2672-11-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2672-12-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2672-13-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2672-39-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/540-56-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2672-60-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/540-90-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
776	svchost.exe
540	svchost.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2844 wrote to memory of 2672	2844	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	96
PID 2672 wrote to memory of 3252	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	97
PID 2672 wrote to memory of 3252	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	97
PID 2672 wrote to memory of 3252	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	97
PID 3252 wrote to memory of 3580	3252	cmd.exe	101
PID 3252 wrote to memory of 3580	3252	cmd.exe	101
PID 3252 wrote to memory of 3580	3252	cmd.exe	101
PID 2672 wrote to memory of 776	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	102
PID 2672 wrote to memory of 776	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	102
PID 2672 wrote to memory of 776	2672	560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe	102
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 540	776	svchost.exe	103
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 776 wrote to memory of 2372	776	svchost.exe	104
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105
PID 2372 wrote to memory of 4532	2372	svchost.exe	105

C:\Users\Admin\AppData\Local\Temp\560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
"C:\Users\Admin\AppData\Local\Temp\560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
  "C:\Users\Admin\AppData\Local\Temp\560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BGVWU.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\svchost.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3580
- - C:\Users\Admin\AppData\Roaming\system\svchost.exe
    "C:\Users\Admin\AppData\Roaming\system\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Users\Admin\AppData\Roaming\system\svchost.exe
      "C:\Users\Admin\AppData\Roaming\system\svchost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:540
  - - C:\Users\Admin\AppData\Roaming\system\svchost.exe
      "C:\Users\Admin\AppData\Roaming\system\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Users\Admin\AppData\Roaming\system\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\system\svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxz.exe

Path C:\ProgramData\cxz.exe
Size 294B
SHA256 befff673f7880285c2078f306d18bc9e9c3f7fe20570063fe689b089be3aff3c
MD5 b6b9fb8e058de7052ce914f45470d694
SHA1 722c36a94747d229067ac7f22f439c948fa7384b
SHA512 f7b739621d5bf2a17821ba5e461bc5f12a652974b27a9576b99344b52497d2abe2de8d28e4049215ad0513e61dc386277de533529b0cc917b86a25f67cb21a25
MD5 SHA1 SHA512

Submit Download

560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe

Path C:\Users\Admin\AppData\Local\Temp\560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea.exe
Size 76KB
SHA256 560085d5289231751e3ae4cb95b020cec5cda5a65caddbce712c347b496488ea
MD5 5dd6cf9394bf425eaf924a8ab168b15e
SHA1 5932f89a082a376cf2cd8187d04541dfeb39623f
SHA512 be3d845516a96524a1789cb0048dcf40c7d9c535c164fbcf3bf4c430c739a7ce58b9f9bcf3801608ddc98a1da7cfb23aaec918474007504be3cb6513dd0c62da
SSDEEP 1536:MvP69lUyW1UwzJmWRaD1gXI7uMrpzrnacxfzZ1:G69lU2UmWVXI7uMlzTFz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

BGVWU.txt

Path C:\Users\Admin\AppData\Local\Temp\BGVWU.txt
Size 148B
SHA256 61ae6f17d637624fd66d1dfad93a1c6a863aa7caf67d3e267910f4b9212bdf52
MD5 05d958f804a3cb770b18371699915faf
SHA1 82e91a19f4f23340db8bb5c7d271aa0b590ff723
SHA512 3ff7be267167f2c447e9aeef2f5e84785dd45d08a10738b1b4c1b01b21d3ea29e637ede50b1091211b97fd40ae5b2bea54e053200778228ffde852f8a19ce921
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\system\svchost.exe
Size 76KB
SHA256 8d47261ed6f97fbef297b71e1dba7032bf0ffddcbd8c10f2e07caf07185afc62
MD5 cf35e557f45d6335fc612ee73b6f6aac
SHA1 2c81ab959f9fb67364a6a9a1f9431da367bc6ce7
SHA512 086b8f7478c7e4fcd44ed7b15c43942a56bd5c8da9d80a6a202ac9f74b8852284cfe4aefea83dd132e4b620ecc9c5bd5c33501c78181f9c63ba339f4920995ce
SSDEEP 1536:MvP69lUyW1UwzJmWRaD1gXI7uMrpzrnacxfzZ1:G69lU2UmWVXI7uMlzTFz7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-90-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/540-56-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/776-42-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/776-41-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/776-43-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/776-57-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2372-62-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2372-51-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2372-55-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2372-46-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2672-11-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2672-60-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2672-13-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2672-12-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2672-39-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2672-7-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2844-2-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/2844-6-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/2844-5-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/2844-4-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/2844-3-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/4532-61-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4532-66-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4532-88-0x0000000000400000-0x0000000000404000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads