6a6bdca6653405f741177f8f141bf3231ba7e17c14da81a1d8286803ed866d18

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Size

1.7MB
MD5

1d572147e37c4766851afec9c30aacf9
SHA1

cee9e2191859ccbbb259329684bd1849056a3622
SHA256

6177136bd2ab5a59885aed70a333b5b59885bc9457bd36a98f176f6d26c8b530
SHA512

24f30d63ff61f729af2f84558b5f42778921be921706e182cbf58aa12637c44bc3967ec8e29583924791724b1af54db697a22bea4b8a02bede1cb21ed9f453c5
SSDEEP

49152:7JZoQrbTFZY1iaC3q3z8JFExUq4IoBNA13:7trbTA1Xz8EPTx13

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\leucoryx.vbs	leucoryx.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	leucoryx.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000022efc-14.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	3728	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leucoryx.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
3728	leucoryx.exe
3728	leucoryx.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
3728	leucoryx.exe
3728	leucoryx.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89

C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Keily\leucoryx.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 756
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3728 -ip 3728
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Keily\leucoryx.exe

Filesize
1.7MB

MD5
1d572147e37c4766851afec9c30aacf9

SHA1
cee9e2191859ccbbb259329684bd1849056a3622

SHA256
6177136bd2ab5a59885aed70a333b5b59885bc9457bd36a98f176f6d26c8b530

SHA512
24f30d63ff61f729af2f84558b5f42778921be921706e182cbf58aa12637c44bc3967ec8e29583924791724b1af54db697a22bea4b8a02bede1cb21ed9f453c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\misrun

Filesize
1.5MB

MD5
fa426b72f63fd9287636e7e4ba1e0483

SHA1
376d7665be7ba5a0676647d2c0ea053b741722bb

SHA256
c7ba59a9365363ac2b0e0816073c8bab9f70ce8493fed74e8078a589cf82fd42

SHA512
40738a48fefa98abac626951b7f741fb0b05c578454c1227cde14b048ef5765930fc52dcf018b1cac5f693c195bf5a0bb46d9dd9c1479e7528cafb5f551b53b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\renowner

Filesize
140KB

MD5
a939bf44771dcb9e74e043255059a6ad

SHA1
aa5434381ba69b69acec1715a5eaf8f78bd694fb

SHA256
56ff08e6c414a9704e2fb8666cf3a5e628453fc4493e84bc88614490c674c335

SHA512
25037b30c80b05fec07f59ff7d870ec8bc85c85086b21cb7a923c31021860354b7e699b3d0feb74837372e3253c2e2380de81fefc30637d6a5e9ef5b9b23be1a

Download Submit
memory/1896-11-0x00000000032E0000-0x00000000033E0000-memory.dmp

Filesize
1024KB

Download
memory/3728-29-0x0000000002A50000-0x0000000002B50000-memory.dmp

Filesize
1024KB

Download