08cde936cf0aea2a3eaa1af53e8e2de33a7a7e240f481ac1457c835555abbce7

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chrome32-64win-e2.exe
Size

49.5MB
MD5

9a92fb642c8de2a418b0002964795915
SHA1

2842060fa391d281ba178cee76c8997445795753
SHA256

08cde936cf0aea2a3eaa1af53e8e2de33a7a7e240f481ac1457c835555abbce7
SHA512

62522809c52d928bfafc950d3d8be6d0b1c605f03e55b893792e494bc4dfb17876cc36acf9ae01c447b7192b417cc20b172da26312ced54de92838fa54eb1c16
SSDEEP

786432:HwLW+U5I9Zm9jm9jm9jm9jm9jm9jm9jm9jm95:0W+KumNmNmNmNmNmNmNmNmD

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Chrome32-64win-e2.exe

Executes dropped EXE 1 IoCs

pid	Process
2880	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
2880	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2880	irsetup.exe
2880	irsetup.exe
2880	irsetup.exe
2880	irsetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2880	3588	Chrome32-64win-e2.exe	83
PID 3588 wrote to memory of 2880	3588	Chrome32-64win-e2.exe	83

C:\Users\Admin\AppData\Local\Temp\Chrome32-64win-e2.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome32-64win-e2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5617698 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Chrome32-64win-e2.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3350944739-639801879-157714471-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
4.9MB

MD5
b0a1f1e0a106e1a62753c8a07fb3809b

SHA1
b4bab82aa173a401a2f16f8b4ad91105a895b2d9

SHA256
f7e07f7936269756bb73e91c8b280c2ab8532fb5bf15085d96eaebc7a05a8950

SHA512
ffc97976471e26e938e0389b33c0143b4a55653f90ee35f8220663b2a78fc48a106a204dd25c990817a57f3670d41fd1361cbdbc3bc4894ded882b356649c083

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
350KB

MD5
c916c7815286c5233a49deac81f8543e

SHA1
cb964c3c8eae8e7ce170f3ad3a55993f7a1918db

SHA256
3d07466b8f5c18afc70c6a9746d43fa7daa39c9bd41e8bfb928c70e7d7458bf4

SHA512
0d65283c41c30ee688bf02ec3eec7f6b17a750efc18fa6a66f26c7c6ef8bae860d270b31017f096d8d254c2769be2b7ed64d6b3dc659d1b57d466388271e2c78

Download Submit