35916e8b40ec27b8f3a931566a94f5a464dc9e5783c7fca1bdd194e7193bf0d7

Analysis

max time kernel
102s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe
Size

369KB
MD5

b6c96e7e2111b5ee133675104824493c
SHA1

abf5259cbaf7e73721523719bee61a5586c47d21
SHA256

d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db
SHA512

3a4e395961ad70a806df4dd16ccac9ee6d692ffb4f7180c3409ad9dc8168c4f28f83b8201d3f2a7bde01f6bc820993881b85905e5768faf769a50649d1a096c0
SSDEEP

6144:2n6zJ4mHcCLCYTnWz79nWz7NYp6hYp6rvDLuimKkBREsVf+3Kg4:16m2QiQrfqREx4

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe

Executes dropped EXE 1 IoCs

pid	Process
4624	t51fle88EnII.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t51fle88EnII.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4584	ipconfig.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1132	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	88
PID 2504 wrote to memory of 1132	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	88
PID 2504 wrote to memory of 1132	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	88
PID 1132 wrote to memory of 4584	1132	cmd.exe	90
PID 1132 wrote to memory of 4584	1132	cmd.exe	90
PID 1132 wrote to memory of 4584	1132	cmd.exe	90
PID 2504 wrote to memory of 4624	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	91
PID 2504 wrote to memory of 4624	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	91
PID 2504 wrote to memory of 4624	2504	d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe	91

C:\Users\Admin\AppData\Local\Temp\d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe
"C:\Users\Admin\AppData\Local\Temp\d72c4b8c14b424737ffaaef76a9e591144b983e79322541f28ea06b4436e42db.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\t51fle88EnII.exe
  "C:\Users\Admin\AppData\Local\Temp\t51fle88EnII.exe" s
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\t51fle88EnII.exe

Filesize
371KB

MD5
9fa69eedd284ac7747b862778c18671d

SHA1
9bd7b8a063c22b11beb394491c49649ba5055a15

SHA256
65265e4ad09e624e666386418f2a77340a7a7783342f7b005e0955f6631c370c

SHA512
8338ee6256faa04f9ba282f707918ad609f0dfd87cb26aac472106a6e375126376e3d9a5c9e8e8deca120bfa1c3c5d725a84a5d858fb88c582e1d5e016ac2dcd

Download Submit
memory/2504-20-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/2504-2-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/2504-1-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/2504-19-0x0000000074F72000-0x0000000074F73000-memory.dmp

Filesize
4KB

Download
memory/2504-0-0x0000000074F72000-0x0000000074F73000-memory.dmp

Filesize
4KB

Download
memory/2504-21-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/2504-22-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-14-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-16-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-15-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-17-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-23-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download
memory/4624-24-0x0000000074F70000-0x0000000075521000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads