Analysis
-
max time kernel
118s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:29
Behavioral task
behavioral1
Sample
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
Resource
win10v2004-20241007-en
General
-
Target
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
-
Size
102KB
-
MD5
0e540262593387d5ef74e5ea9b1cf920
-
SHA1
9b2b9467a84d4696820879a5e1dc229584770de0
-
SHA256
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bf
-
SHA512
ca9c4815a571c27a68ddafdeec0523741639e477e6df95da04be035812b5d2990cc186264fbf10dbd45905b4a140bad97c454b9e90b0bcdc7abf2139f85fdec0
-
SSDEEP
3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe -
Executes dropped EXE 3 IoCs
Processes:
WindowsService.exeWindowsService.exeWindowsService.exepid process 3328 WindowsService.exe 812 WindowsService.exe 1848 WindowsService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exeWindowsService.exedescription pid process target process PID 4100 set thread context of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 3328 set thread context of 812 3328 WindowsService.exe WindowsService.exe PID 3328 set thread context of 1848 3328 WindowsService.exe WindowsService.exe -
Processes:
resource yara_rule behavioral2/memory/4100-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4100-4-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4844-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4844-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4844-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4100-13-0x0000000000400000-0x000000000043B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe upx behavioral2/memory/3328-37-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4844-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3328-42-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3328-44-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3328-43-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/3328-58-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral2/memory/4844-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/812-61-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.execmd.exereg.exeWindowsService.exeWindowsService.exeWindowsService.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WindowsService.exedescription pid process Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe Token: SeDebugPrivilege 812 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exeWindowsService.exeWindowsService.exepid process 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3328 WindowsService.exe 812 WindowsService.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.execmd.exeWindowsService.exedescription pid process target process PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4100 wrote to memory of 4844 4100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 4844 wrote to memory of 4120 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 4844 wrote to memory of 4120 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 4844 wrote to memory of 4120 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 4120 wrote to memory of 5012 4120 cmd.exe reg.exe PID 4120 wrote to memory of 5012 4120 cmd.exe reg.exe PID 4120 wrote to memory of 5012 4120 cmd.exe reg.exe PID 4844 wrote to memory of 3328 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 4844 wrote to memory of 3328 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 4844 wrote to memory of 3328 4844 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 812 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe PID 3328 wrote to memory of 1848 3328 WindowsService.exe WindowsService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ENXVF.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
102KB
MD5a4d112f962410f1813630675c40f9d0d
SHA118dcfe79bb20f0868c4225ae3241ee01a3c47a64
SHA256a8a692fe6a40b2fdd81081dfa74efc21083dd17bc6fd1ec566fd13520da3840a
SHA51292af46a5a1af4a13ee8cd6c91c9d421781ad8c88a164ddfc52e612073e75941bd0a70a6c722d038798ed3d407d884e095003573e8fb421a82bcb01aaa30c7329