5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d

General

Target

5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe
Size

280KB
MD5

9eba144eb34351954d5cb58220c7c72c
SHA1

94d629fae72f9e251a30281cb0838af086107a44
SHA256

5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d
SHA512

f14c59e4bb494093da204344e5c55ad8ea7cd3e1260fb0083b258b3e1ffa3a94d55e02ba7bf9e449dcb5378044c49d7694f63a595c4dcd5fe1dc51db0ae696d3
SSDEEP

6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fb:boSeGUA5YZazpXUmZhZ6T

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe

Executes dropped EXE 1 IoCs

pid	Process
2976	a1punf5t2of.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe"	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1punf5t2of.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2976	1340	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe	84
PID 1340 wrote to memory of 2976	1340	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe	84
PID 1340 wrote to memory of 2976	1340	5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe	84
PID 2976 wrote to memory of 3276	2976	a1punf5t2of.exe	89
PID 2976 wrote to memory of 3276	2976	a1punf5t2of.exe	89
PID 2976 wrote to memory of 3276	2976	a1punf5t2of.exe	89

C:\Users\Admin\AppData\Local\Temp\5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe
"C:\Users\Admin\AppData\Local\Temp\5367a32045767b8af7e9bdcb26ce5589be82f4df2bae6c54c8f632fbbd48e51d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
  "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe
    "C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"
    3⤵
    PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe

Filesize
280KB

MD5
8975aa6d85b1ea3ed0d3c9230510d443

SHA1
742bdfb8c12daeeb0cd49e6b36a730da3c2a8c46

SHA256
d4116a46db952f8eb31c87de7ef5856fc43bface47c59ed103ec6a48029ee0c3

SHA512
d0aeb7ba6bfe8ad271257cf3eddb5fd7e440fd3ceede73ad902ef21f53148dd80e7b2adfd173c32404667f97f58f863354be39f99b3faf9dbe2678ba242e228e

Download Submit
memory/1340-4-0x0000000075452000-0x0000000075453000-memory.dmp

Filesize
4KB

Download
memory/1340-1-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-3-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-0-0x0000000075452000-0x0000000075453000-memory.dmp

Filesize
4KB

Download
memory/1340-5-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-6-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-2-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-7-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/1340-21-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-22-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-23-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-24-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-25-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-26-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-27-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/2976-29-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads