dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c

Analysis

max time kernel
127s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe
Size

437KB
MD5

d317ee086ebeccf5e01e002ca6b0ead9
SHA1

48e8c5846d9c67649b3c2fb8d76aa951828dd84e
SHA256

dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c
SHA512

5fc335758f587e9f9f35309b101c16a4e2faa840013f8024f45eb33b9aa402a2877cbc07f76f389d25e2cf20607486997218de52c46364e2c89a5fa28a785032
SSDEEP

12288:fHxmm31uLFn23TURCwbH8SnBkKuJ+RctSaWrQz:/BuLFn2DUELSS7s

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe

Executes dropped EXE 3 IoCs

pid	Process
3484	Dctooux.exe
2668	Dctooux.exe
4280	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dctooux.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1332	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3484	1332	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe	83
PID 1332 wrote to memory of 3484	1332	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe	83
PID 1332 wrote to memory of 3484	1332	dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe	83

C:\Users\Admin\AppData\Local\Temp\dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe
"C:\Users\Admin\AppData\Local\Temp\dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484

C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\431a343abc\Dctooux.exe

Filesize
437KB

MD5
d317ee086ebeccf5e01e002ca6b0ead9

SHA1
48e8c5846d9c67649b3c2fb8d76aa951828dd84e

SHA256
dfdc0318f3dc5ba3f960b1f338b638cd9645856d2a2af8aa33ea0f9979a9ca4c

SHA512
5fc335758f587e9f9f35309b101c16a4e2faa840013f8024f45eb33b9aa402a2877cbc07f76f389d25e2cf20607486997218de52c46364e2c89a5fa28a785032

Download Submit
C:\Users\Admin\AppData\Local\Temp\878641211696

Filesize
84KB

MD5
5e27dc6954473c221ba974528c7d9e7e

SHA1
1a51fa64011add653308d8360668f995f9821599

SHA256
ec4b67467b0876eb0b2972e3d22fc44dc58aceb8ad9cd89fbc9a892989a587a3

SHA512
4a8b8b253e41658b6016224664eb515e3c88c5c87e0e5fc7f01a3716de46369480ecee0aa7365ffa9ac668d8645a143757ab1d9782dc8e889d13a8b600e3d43f

Download Submit
C:\Users\Admin\AppData\Roaming\bfbcc7a80c10a7\cred64.dll

Filesize
4KB

MD5
5a513c895a09340836c8e6f1d7cc9800

SHA1
b915c43acf4aa004464d3dd2f81d2c20ecf76b81

SHA256
569bb589d778c144772718f393ec191880368a79cd43b3ee3b035f4e5e01cae4

SHA512
c731f450b762e161425bda0110fbb24b1ecc973b67893d259e82c24d1ee8cd2f23b1559e51759fc8a7f0a5c797e9783adb5a4686de52df7bec414b0317ba0933

Download Submit