Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe
Resource
win10v2004-20241007-en
General
-
Target
5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe
-
Size
39KB
-
MD5
b8e57476e1e1341c96689df2dbfb7bc0
-
SHA1
3a6d5716488cde3384488919c2b199689f4e5354
-
SHA256
5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447a
-
SHA512
474bd38e924790c18949a388fcd46050fb7f4eba6cba488a6e2d3ac69100c1370b3490e2c0db6f8a39a0720893f17eade3743d6394aa3302bb46f5951901a775
-
SSDEEP
768:JSfL/76As1FdMQ8RjaeeILtQhRSSDSIjM:Je76AM6QCjsI8zjM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation opera_autoupdater.exe -
Executes dropped EXE 1 IoCs
pid Process 2164 opera_autoupdater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opera_autoupdater.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2164 3068 5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe 83 PID 3068 wrote to memory of 2164 3068 5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe 83 PID 3068 wrote to memory of 2164 3068 5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe"C:\Users\Admin\AppData\Local\Temp\5edeb619f4a5c3cdb7a396ab0c11951a3003ce976ba08857fe9ad3c7ddca447aN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5ae5466162ddcb4b2a2f797c3f1d67e1c
SHA1b92594f7873f64c8f7043db6ff4f09d2a607ddf0
SHA2562e294c3c4ee49fb933c14b30cc17147a7b8140a27614a07f34d6857618bcb256
SHA512c181e8a3ace975f1dd9c7f545af54a878d1bc530c619f659331894741270d57e904568dd234bdbb74c32ee5155b995e34e4b118d1f126301205c1330067dc4bc