Overview
overview
10Static
static
10d1773dbf85...14.exe
windows7-x64
10d1773dbf85...14.exe
windows10-2004-x64
10d17833b5ad...14.exe
windows7-x64
10d17833b5ad...14.exe
windows10-2004-x64
10d19713a05b...60.exe
windows7-x64
10d19713a05b...60.exe
windows10-2004-x64
10d1a0b78620...86.exe
windows7-x64
10d1a0b78620...86.exe
windows10-2004-x64
10d1a62cde3f...76.exe
windows7-x64
9d1a62cde3f...76.exe
windows10-2004-x64
9d1ae74abc0...a4.exe
windows7-x64
3d1ae74abc0...a4.exe
windows10-2004-x64
3d1b8645939...8c.exe
windows7-x64
10d1b8645939...8c.exe
windows10-2004-x64
10d1d65f62ac...0f.exe
windows7-x64
3d1d65f62ac...0f.exe
windows10-2004-x64
10d1ec8c3742...5d.exe
windows7-x64
10d1ec8c3742...5d.exe
windows10-2004-x64
10d21427a7a6...37.exe
windows7-x64
7d21427a7a6...37.exe
windows10-2004-x64
7d2181d9845...ce.exe
windows7-x64
1d2181d9845...ce.exe
windows10-2004-x64
1d22a2ed71b...4e.exe
windows7-x64
7d22a2ed71b...4e.exe
windows10-2004-x64
10d23977a7d2...dd.exe
windows7-x64
10d23977a7d2...dd.exe
windows10-2004-x64
10d27cca2711...26.exe
windows7-x64
10d27cca2711...26.exe
windows10-2004-x64
10d28eec4485...4b.exe
windows7-x64
7d28eec4485...4b.exe
windows10-2004-x64
7d2b881f205...1d.exe
windows7-x64
10d2b881f205...1d.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
d1773dbf85d917eb86780278256b5314.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
d1773dbf85d917eb86780278256b5314.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
d17833b5ad52144ac94274f3623e730f247aec0b6cd5d8cea6e910c898bac914.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
d17833b5ad52144ac94274f3623e730f247aec0b6cd5d8cea6e910c898bac914.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
d19713a05b239bb9c15e350f22976c60.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
d19713a05b239bb9c15e350f22976c60.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
d1a0b78620011cdf2da572aca494dc7841cb4ca79d073b671d522434894ab086.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
d1a0b78620011cdf2da572aca494dc7841cb4ca79d073b671d522434894ab086.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral10
Sample
d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d1ae74abc0c8514f363c90e1a9b02aa4.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
d1ae74abc0c8514f363c90e1a9b02aa4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
d1b8645939d08182047951aa23291fa83dff7f397528319b6be11cb24885598c.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
d1b8645939d08182047951aa23291fa83dff7f397528319b6be11cb24885598c.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d1d65f62acce133f4e44c137020c260f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
d1d65f62acce133f4e44c137020c260f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
d1ec8c3742e4e01173d709df1353dc5d.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
d1ec8c3742e4e01173d709df1353dc5d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
d21427a7a658882f85cfc0f0494d2337.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
d21427a7a658882f85cfc0f0494d2337.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
d2181d98457190fa4bf7c49a700a5dfacba23a30d6377e5616aa9268c828dbce.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
d2181d98457190fa4bf7c49a700a5dfacba23a30d6377e5616aa9268c828dbce.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
d22a2ed71bc83120e890a0b31d49984e.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral24
Sample
d22a2ed71bc83120e890a0b31d49984e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
d23977a7d2d13a4481eabc68752bf8dd.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
d23977a7d2d13a4481eabc68752bf8dd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
d27cca271192c44b146218aa9a2e4926.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
d27cca271192c44b146218aa9a2e4926.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
d28eec44852da7258b49d5816a13e6fbb31a34b744a327656950df56f3fef14b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
d28eec44852da7258b49d5816a13e6fbb31a34b744a327656950df56f3fef14b.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
d2b881f2057c461af88b09179c137e9cf316304860ffe392700d143a4082fb1d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
d2b881f2057c461af88b09179c137e9cf316304860ffe392700d143a4082fb1d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
d21427a7a658882f85cfc0f0494d2337.exe
-
Size
1.4MB
-
MD5
d21427a7a658882f85cfc0f0494d2337
-
SHA1
a3c7e31aa7beffc0b8c0fddbf140994ca07ed95f
-
SHA256
2ef232eae08620c8b18e4a139d126d3da312053701aaebd3032fb638fb553eae
-
SHA512
e606969e162951b2a93dcd2a7271cc423b65adcc8e9b66ee95d3e13bac0611714f93bcb7a74a309a8eabeb541c40bc106c5b458b8e14ac24c7dd5a7ccc6cfc88
-
SSDEEP
24576:V8dvIOVmW6AbPsArkueRKmV3sNlHfiqJIM:VowONbkBuyKmBs7iM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation d21427a7a658882f85cfc0f0494d2337.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app_signed.exe d21427a7a658882f85cfc0f0494d2337.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app_signed.exe d21427a7a658882f85cfc0f0494d2337.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe d21427a7a658882f85cfc0f0494d2337.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe d21427a7a658882f85cfc0f0494d2337.exe -
Executes dropped EXE 3 IoCs
pid Process 3940 app.exe 2936 app.exe 4876 app.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\app.exe" d21427a7a658882f85cfc0f0494d2337.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3940 set thread context of 4876 3940 app.exe 106 PID 3940 set thread context of 2936 3940 app.exe 107 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d21427a7a658882f85cfc0f0494d2337.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4000 d21427a7a658882f85cfc0f0494d2337.exe 4000 d21427a7a658882f85cfc0f0494d2337.exe 4000 d21427a7a658882f85cfc0f0494d2337.exe 4000 d21427a7a658882f85cfc0f0494d2337.exe 4000 d21427a7a658882f85cfc0f0494d2337.exe 4000 d21427a7a658882f85cfc0f0494d2337.exe 3940 app.exe 3940 app.exe 3940 app.exe 3940 app.exe 3940 app.exe 3940 app.exe 3940 app.exe 3940 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe 4876 app.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4000 d21427a7a658882f85cfc0f0494d2337.exe Token: SeDebugPrivilege 3940 app.exe Token: SeDebugPrivilege 4876 app.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4876 app.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4000 wrote to memory of 3940 4000 d21427a7a658882f85cfc0f0494d2337.exe 96 PID 4000 wrote to memory of 3940 4000 d21427a7a658882f85cfc0f0494d2337.exe 96 PID 4000 wrote to memory of 3940 4000 d21427a7a658882f85cfc0f0494d2337.exe 96 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 4876 3940 app.exe 106 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 2936 3940 app.exe 107 PID 3940 wrote to memory of 2936 3940 app.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21427a7a658882f85cfc0f0494d2337.exe"C:\Users\Admin\AppData\Local\Temp\d21427a7a658882f85cfc0f0494d2337.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4876
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD529683f5b4ad272c624cc2069e9b39573
SHA1dab6f53e6bf60cdd6ee20850235a85a10d57f28b
SHA25604f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e
SHA5120ea2b3e67766f36d202850b5ad639383285eb93c7f626430b20f40990bd2a7e5f405ec91b782f3e1b12bc255a7637831114df06f753c039bf8774946752a48e5