80077994550acf0276127b56d3b7d3878c36d47f2c7dee7537a73529c9a263cf

Resubmissions

27-11-2024 11:27

241127-nkv7dsxrgp 7

27-11-2024 11:24

241127-nh5m2s1pdz 7

Analysis

max time kernel
48s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Next-Time75 Edit/X-75-RGB.exe
Size

3.5MB
MD5

ca9c168350f93afaf0a70a4d83ba1119
SHA1

8156bd5d64adb3cb942c978ed2f2415efe397c54
SHA256

12023d0e55e7de318b70a25c18ab635781ae1745ab7005dd3b33a1a7713f5a91
SHA512

09806765e4a72fe39d2416df31c7b129984cc147e8cb0653eb81c016fe09dbff3eac65757a7514b5ef53dd0d496c146f8fa8a5e4c0bdc98b89162a6f01907074
SSDEEP

49152:p2/PpDKqPqXdQxupyw6+HN+AZvEGuKtJelCuYuaYX1lUEgR4VD1:0PpDKqPGuxupBP5ZchKtJelEu1U

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	X-75-RGB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X-75-RGB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LightRecord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	X-75-RGB.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1848	X-75-RGB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 4592	1848	X-75-RGB.exe	82
PID 1848 wrote to memory of 4592	1848	X-75-RGB.exe	82
PID 1848 wrote to memory of 4592	1848	X-75-RGB.exe	82
PID 1848 wrote to memory of 3552	1848	X-75-RGB.exe	84
PID 1848 wrote to memory of 3552	1848	X-75-RGB.exe	84
PID 1848 wrote to memory of 3552	1848	X-75-RGB.exe	84
PID 1848 wrote to memory of 3560	1848	X-75-RGB.exe	91
PID 1848 wrote to memory of 3560	1848	X-75-RGB.exe	91
PID 1848 wrote to memory of 3560	1848	X-75-RGB.exe	91
PID 1848 wrote to memory of 872	1848	X-75-RGB.exe	92
PID 1848 wrote to memory of 872	1848	X-75-RGB.exe	92
PID 1848 wrote to memory of 872	1848	X-75-RGB.exe	92
PID 1848 wrote to memory of 3168	1848	X-75-RGB.exe	95
PID 1848 wrote to memory of 3168	1848	X-75-RGB.exe	95
PID 1848 wrote to memory of 3168	1848	X-75-RGB.exe	95
PID 1848 wrote to memory of 4080	1848	X-75-RGB.exe	96
PID 1848 wrote to memory of 4080	1848	X-75-RGB.exe	96
PID 1848 wrote to memory of 4080	1848	X-75-RGB.exe	96
PID 1848 wrote to memory of 4800	1848	X-75-RGB.exe	101
PID 1848 wrote to memory of 4800	1848	X-75-RGB.exe	101
PID 1848 wrote to memory of 4800	1848	X-75-RGB.exe	101
PID 1848 wrote to memory of 1444	1848	X-75-RGB.exe	102
PID 1848 wrote to memory of 1444	1848	X-75-RGB.exe	102
PID 1848 wrote to memory of 1444	1848	X-75-RGB.exe	102
PID 1848 wrote to memory of 4992	1848	X-75-RGB.exe	103
PID 1848 wrote to memory of 4992	1848	X-75-RGB.exe	103
PID 1848 wrote to memory of 4992	1848	X-75-RGB.exe	103
PID 1848 wrote to memory of 4060	1848	X-75-RGB.exe	104
PID 1848 wrote to memory of 4060	1848	X-75-RGB.exe	104
PID 1848 wrote to memory of 4060	1848	X-75-RGB.exe	104
PID 1848 wrote to memory of 2868	1848	X-75-RGB.exe	105
PID 1848 wrote to memory of 2868	1848	X-75-RGB.exe	105
PID 1848 wrote to memory of 2868	1848	X-75-RGB.exe	105
PID 1848 wrote to memory of 3808	1848	X-75-RGB.exe	106
PID 1848 wrote to memory of 3808	1848	X-75-RGB.exe	106
PID 1848 wrote to memory of 3808	1848	X-75-RGB.exe	106
PID 1848 wrote to memory of 4820	1848	X-75-RGB.exe	107
PID 1848 wrote to memory of 4820	1848	X-75-RGB.exe	107
PID 1848 wrote to memory of 4820	1848	X-75-RGB.exe	107
PID 1848 wrote to memory of 2704	1848	X-75-RGB.exe	108
PID 1848 wrote to memory of 2704	1848	X-75-RGB.exe	108
PID 1848 wrote to memory of 2704	1848	X-75-RGB.exe	108
PID 1848 wrote to memory of 4772	1848	X-75-RGB.exe	109
PID 1848 wrote to memory of 4772	1848	X-75-RGB.exe	109
PID 1848 wrote to memory of 4772	1848	X-75-RGB.exe	109
PID 1848 wrote to memory of 4852	1848	X-75-RGB.exe	110
PID 1848 wrote to memory of 4852	1848	X-75-RGB.exe	110
PID 1848 wrote to memory of 4852	1848	X-75-RGB.exe	110
PID 1848 wrote to memory of 4548	1848	X-75-RGB.exe	111
PID 1848 wrote to memory of 4548	1848	X-75-RGB.exe	111
PID 1848 wrote to memory of 4548	1848	X-75-RGB.exe	111
PID 1848 wrote to memory of 4488	1848	X-75-RGB.exe	112
PID 1848 wrote to memory of 4488	1848	X-75-RGB.exe	112
PID 1848 wrote to memory of 4488	1848	X-75-RGB.exe	112
PID 1848 wrote to memory of 1340	1848	X-75-RGB.exe	113
PID 1848 wrote to memory of 1340	1848	X-75-RGB.exe	113
PID 1848 wrote to memory of 1340	1848	X-75-RGB.exe	113
PID 1848 wrote to memory of 64	1848	X-75-RGB.exe	117
PID 1848 wrote to memory of 64	1848	X-75-RGB.exe	117
PID 1848 wrote to memory of 64	1848	X-75-RGB.exe	117
PID 1848 wrote to memory of 4888	1848	X-75-RGB.exe	118
PID 1848 wrote to memory of 4888	1848	X-75-RGB.exe	118
PID 1848 wrote to memory of 4888	1848	X-75-RGB.exe	118
PID 1848 wrote to memory of 1516	1848	X-75-RGB.exe	119

C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\X-75-RGB.exe
"C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\X-75-RGB.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3552
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:872
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:64
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:804
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:3804
- C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe
  "C:\Users\Admin\AppData\Local\Temp\Next-Time75 Edit\LightRecord.exe"
  2⤵
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\X-75-RGB\mouse\ShootData_2.Shoot

Filesize
13KB

MD5
711f5bb63c9276cc228ee5d06ce12dfd

SHA1
bfa9bb78775c130bc99c1f7b1e31b6311d7bff93

SHA256
45ae9981d9d7b0c2fc1b0142b8a20e3a3ba8be6df4ae241670d53c307b2dfc18

SHA512
fea31aee1396c3e735a499e159ca86e4c375cd398cc9236325953e5fcef3c648d491686c1f5ca894bd2bdfc01b9bc93fd8d1caaa9f7d9dc2df9aeb612bc48d91

Download Submit