6a6bdca6653405f741177f8f141bf3231ba7e17c14da81a1d8286803ed866d18

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Size 1.7MB
Sample241113-cawjmaxpdn
SHA256 6177136bd2ab5a59885aed70a333b5b59885bc9457bd36a98f176f6d26c8b530
MD5 1d572147e37c4766851afec9c30aacf9
SHA1 cee9e2191859ccbbb259329684bd1849056a3622
SHA512 24f30d63ff61f729af2f84558b5f42778921be921706e182cbf58aa12637c44bc3967ec8e29583924791724b1af54db697a22bea4b8a02bede1cb21ed9f453c5
SSDEEP 49152:7JZoQrbTFZY1iaC3q3z8JFExUq4IoBNA13:7trbTA1Xz8EPTx13
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\leucoryx.vbs	leucoryx.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	leucoryx.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000022efc-14.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	3728	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leucoryx.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
3728	leucoryx.exe
3728	leucoryx.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
3728	leucoryx.exe
3728	leucoryx.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 1896 wrote to memory of 3728	1896	RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe	86
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89
PID 3728 wrote to memory of 2976	3728	leucoryx.exe	89

C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Keily\leucoryx.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ_HYU-241002863 SQ-242000846그리고 PO-248000263.exe"
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 756
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3728 -ip 3728
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

leucoryx.exe

Path C:\Users\Admin\AppData\Local\Keily\leucoryx.exe
Size 1.7MB
SHA256 6177136bd2ab5a59885aed70a333b5b59885bc9457bd36a98f176f6d26c8b530
MD5 1d572147e37c4766851afec9c30aacf9
SHA1 cee9e2191859ccbbb259329684bd1849056a3622
SHA512 24f30d63ff61f729af2f84558b5f42778921be921706e182cbf58aa12637c44bc3967ec8e29583924791724b1af54db697a22bea4b8a02bede1cb21ed9f453c5
SSDEEP 49152:7JZoQrbTFZY1iaC3q3z8JFExUq4IoBNA13:7trbTA1Xz8EPTx13
MD5 SHA1 SHA512 SSDEEP

Submit Download

misrun

Path C:\Users\Admin\AppData\Local\Temp\misrun
Size 1.5MB
SHA256 c7ba59a9365363ac2b0e0816073c8bab9f70ce8493fed74e8078a589cf82fd42
MD5 fa426b72f63fd9287636e7e4ba1e0483
SHA1 376d7665be7ba5a0676647d2c0ea053b741722bb
SHA512 40738a48fefa98abac626951b7f741fb0b05c578454c1227cde14b048ef5765930fc52dcf018b1cac5f693c195bf5a0bb46d9dd9c1479e7528cafb5f551b53b8
SSDEEP 24576:r/b2dD+vXGT3NOCiBfydVmsBm2ClbT7H3FB289npJOp62:rj2daPE8CiBfydVDm26b/He89a62
MD5 SHA1 SHA512 SSDEEP

Submit Download

renowner

Path C:\Users\Admin\AppData\Local\Temp\renowner
Size 140KB
SHA256 56ff08e6c414a9704e2fb8666cf3a5e628453fc4493e84bc88614490c674c335
MD5 a939bf44771dcb9e74e043255059a6ad
SHA1 aa5434381ba69b69acec1715a5eaf8f78bd694fb
SHA512 25037b30c80b05fec07f59ff7d870ec8bc85c85086b21cb7a923c31021860354b7e699b3d0feb74837372e3253c2e2380de81fefc30637d6a5e9ef5b9b23be1a
SSDEEP 1536:lC6Hbc8Z/kCXWqb6ce6R49+VotMc1fytrng51U:1kjt9S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-11-0x00000000032E0000-0x00000000033E0000-memory.dmp

Download

memory/3728-29-0x0000000002A50000-0x0000000002B50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads