f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Size

311KB
MD5

1e47fa765a3ba96e50fb204baf7c2e8d
SHA1

fe03cbd4b95fae338ca7686c6e5e5a1309f54713
SHA256

6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf
SHA512

b76ec98f006ab559331ee1c76e8285e489dbdcca16756c64b7820e4374958fe9d110a888425e39d3353291c17024fcef6b398c68a28d953685224f68656618a0
SSDEEP

6144:h7Z5ZJygGwy4HZocAZHzdjFnfB12/b1i2gySW:p7iLV55nfB124NW

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe

Executes dropped EXE 1 IoCs

pid	Process
4832	sync.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs

Web Service

T1102

flow	ioc
62	pastebin.com
75	pastebin.com
79	pastebin.com
85	pastebin.com
86	pastebin.com
87	pastebin.com
64	pastebin.com
65	pastebin.com
72	pastebin.com
80	pastebin.com
91	pastebin.com
92	pastebin.com
25	pastebin.com
44	pastebin.com
76	pastebin.com
88	pastebin.com
89	pastebin.com
90	pastebin.com
33	pastebin.com
34	pastebin.com
61	pastebin.com
63	pastebin.com
74	pastebin.com
77	pastebin.com
78	pastebin.com
84	pastebin.com
26	pastebin.com
31	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2780	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Token: SeDebugPrivilege	4832	sync.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4600	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	90
PID 448 wrote to memory of 4600	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	90
PID 448 wrote to memory of 4600	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	90
PID 448 wrote to memory of 4648	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	92
PID 448 wrote to memory of 4648	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	92
PID 448 wrote to memory of 4648	448	6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe	92
PID 4600 wrote to memory of 1140	4600	cmd.exe	94
PID 4600 wrote to memory of 1140	4600	cmd.exe	94
PID 4600 wrote to memory of 1140	4600	cmd.exe	94
PID 4648 wrote to memory of 2780	4648	cmd.exe	95
PID 4648 wrote to memory of 2780	4648	cmd.exe	95
PID 4648 wrote to memory of 2780	4648	cmd.exe	95
PID 4648 wrote to memory of 4832	4648	cmd.exe	98
PID 4648 wrote to memory of 4832	4648	cmd.exe	98
PID 4648 wrote to memory of 4832	4648	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
"C:\Users\Admin\AppData\Local\Temp\6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sync" /tr '"C:\Users\Admin\AppData\Roaming\sync.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sync" /tr '"C:\Users\Admin\AppData\Roaming\sync.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC023.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2780
- - C:\Users\Admin\AppData\Roaming\sync.exe
    "C:\Users\Admin\AppData\Roaming\sync.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC023.tmp.bat

Filesize
148B

MD5
11e7a0eb923fad2a3346c2f16b307ed2

SHA1
c0e2d407e2f831c268c9f696ad6ce58762d24eae

SHA256
0c503f649368b85a0d9f7d830b9d6ae3966415006801581b888e55c7a461ed5f

SHA512
93f001d2aabe33dee5acc16e09cf3d46d61685f58c0a51d3957a98f26af5d6171de286ff63a07d736eb41728c3e023a33c5baed42122340292235406aa59135f

Download Submit
C:\Users\Admin\AppData\Roaming\sync.exe

Filesize
311KB

MD5
1e47fa765a3ba96e50fb204baf7c2e8d

SHA1
fe03cbd4b95fae338ca7686c6e5e5a1309f54713

SHA256
6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf

SHA512
b76ec98f006ab559331ee1c76e8285e489dbdcca16756c64b7820e4374958fe9d110a888425e39d3353291c17024fcef6b398c68a28d953685224f68656618a0

Download Submit
memory/448-6-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/448-3-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/448-4-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/448-5-0x0000000005580000-0x000000000561C000-memory.dmp

Filesize
624KB

Download
memory/448-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

Filesize
4KB

Download
memory/448-2-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/448-1-0x0000000000980000-0x00000000009D4000-memory.dmp

Filesize
336KB

Download
memory/448-17-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-15-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-16-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-18-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-19-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download