8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339

General

Target

8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe
Size

255KB
MD5

99818b30fad7b1cf91e8a7ffb6417630
SHA1

cd3a1c3d3c0233d023c8b3f0a6c04b7f0271c6ba
SHA256

8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339
SHA512

94ee4039ee97cdba52809556d17f2ec6b0facd1f51082f797b7522348b98520479cbb3c196da5944cbb42b0a8960ff7be66b4ef1724112a2e782203d2b54c873
SSDEEP

6144:85p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ+r:EeGUA5YZazpXUmZhlr

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe

Executes dropped EXE 1 IoCs

pid	Process
2928	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2928	1364	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe	100
PID 1364 wrote to memory of 2928	1364	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe	100
PID 1364 wrote to memory of 2928	1364	8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe	100
PID 2928 wrote to memory of 1500	2928	a1punf5t2of.exe	101
PID 2928 wrote to memory of 1500	2928	a1punf5t2of.exe	101
PID 2928 wrote to memory of 1500	2928	a1punf5t2of.exe	101

C:\Users\Admin\AppData\Local\Temp\8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe
"C:\Users\Admin\AppData\Local\Temp\8c62ea1c8a275d9c558c2f8f2ef0d917a1007d86de7273025dd50249fa5e3339N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
255KB

MD5
a63ca49a0aa4d85250d56441405f32fa

SHA1
3c0c4c8a6f35323065c4abc0b2f784cdfd40e2ff

SHA256
6f3495d70776c5a637f79740eafd8438aaffccd6bc55b5134290a922bb9a12b2

SHA512
af5ad255dc35b6b0a1a3e883c8e28a764e15f27bb685b670458051fe5d02be61e7e0575dd80ecb4e063d815ba4ba113f8fce74c160f74360f6d5cc1c99eb21c9

Download Submit
memory/1364-4-0x0000000074952000-0x0000000074953000-memory.dmp

Filesize
4KB

Download
memory/1364-7-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-3-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-0-0x0000000074952000-0x0000000074953000-memory.dmp

Filesize
4KB

Download
memory/1364-21-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-6-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-2-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-1-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1364-5-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-23-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-22-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-24-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-25-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-26-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-27-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/2928-29-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads