Overview
overview
10Static
static
3tmpfile-ma...r3.exe
windows7-x64
8tmpfile-ma...r3.exe
windows10-2004-x64
8tmpfile-ma...rm.exe
windows7-x64
10tmpfile-ma...rm.exe
windows10-2004-x64
10tmpfile-ma...ir.exe
windows7-x64
10tmpfile-ma...ir.exe
windows10-2004-x64
10tmpfile-ma...32.exe
windows7-x64
10tmpfile-ma...32.exe
windows10-2004-x64
10tmpfile-ma...63.exe
windows7-x64
3tmpfile-ma...63.exe
windows10-2004-x64
3tmpfile-ma...64.exe
windows7-x64
10tmpfile-ma...64.exe
windows10-2004-x64
10tmpfile-ma...ox.exe
windows7-x64
7tmpfile-ma...ox.exe
windows10-2004-x64
7tmpfile-ma...7I.exe
windows7-x64
1tmpfile-ma...7I.exe
windows10-2004-x64
1tmpfile-ma...8I.exe
windows7-x64
7tmpfile-ma...8I.exe
windows10-2004-x64
7Analysis
-
max time kernel
93s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
tmpfile-main/0000000r00d000r3.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
tmpfile-main/0000000r00d000r3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
tmpfile-main/Exterm.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
tmpfile-main/Exterm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
tmpfile-main/Gaming Chair.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
tmpfile-main/Gaming Chair.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
tmpfile-main/Node32.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
tmpfile-main/Node32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
tmpfile-main/Node63.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
tmpfile-main/Node63.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
tmpfile-main/Node64.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
tmpfile-main/Node64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
tmpfile-main/Sobfox.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
tmpfile-main/Sobfox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
tmpfile-main/stTfuo7I.exe
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
tmpfile-main/stTfuo7I.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
tmpfile-main/stTfuo8I.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
tmpfile-main/stTfuo8I.exe
Resource
win10v2004-20241007-en
General
-
Target
tmpfile-main/stTfuo8I.exe
-
Size
4.8MB
-
MD5
e9f9aaf1b165f0e1a0310cfe04b7deaf
-
SHA1
512b5d16ccc0a16619e69dda46382f346c1b1d51
-
SHA256
9ab3067a40f40f1e171a5ae3cd036ae9ef32d8cabb0e06502e56fe6df67d6feb
-
SHA512
d2940b5f86e731dae7df1d5f69cc138e03b50a19ff77843fdf61d92035f64449ba3e8948585cfeca709d871ccfd51aca8f734adc09dfde14c8e27d4c972f4d0c
-
SSDEEP
98304:5F+ssBEhz9Nq5s7ydXteaDJ/23nPl2ptbzfoHvoimaTFAeXzl:5Xs2Ju9eaD0tGHfoTmE/D
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation stTfuo8I.exe -
Executes dropped EXE 1 IoCs
pid Process 4560 RDR4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4560 4336 stTfuo8I.exe 86 PID 4336 wrote to memory of 4560 4336 stTfuo8I.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfile-main\stTfuo8I.exe"C:\Users\Admin\AppData\Local\Temp\tmpfile-main\stTfuo8I.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\RDR4.exe"C:\Users\Admin\AppData\Local\Temp\RDR4.exe"2⤵
- Executes dropped EXE
PID:4560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5e685b0c231a5f25f451e3b1628c3a55d
SHA16546666fb75e56302f140db8c8e9299e2ae1175b
SHA25665d2f65bcb32cba0a2d920bec6b139bf5de4de8ad2d44db7ad7bb36035665797
SHA512f991446d9b556bf00c25f348000a75bda67571f0de53a9947c679f483bdae8e7d28728270de530d833321a484a7050c96b57a3c10273bba87e04dd8f07cc03a4