4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

08/04/2025, 14:11

250408-rhjmcsvp15 10

22/03/2025, 06:18

250322-g2ywaay1fy 10

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f780377dd90d33c8280734d882fc2ac9.exe
Size

12KB
MD5

f780377dd90d33c8280734d882fc2ac9
SHA1

2ca8e1e97f1d9893389ea6f7505fe7c24924b387
SHA256

d44c91defb81890cb0045d3a612485a4db65c1f4e52ce405efa453b8a07229e7
SHA512

ffa397cbe485bef45d52cbe19527bd7e16d5fe3847e80844dbb45fe96effefb8f0c3cfdcfa9d164786a063d6bc74a38c99ec2bab132b3841caaefb72b26be643
SSDEEP

384:SL7li/2zcq2DcEQvdfcJKLTp/NK9xa4f:MYMZQ9c4f

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	f780377dd90d33c8280734d882fc2ac9.exe

Deletes itself 1 IoCs

pid	Process
5108	tmpC506.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	tmpC506.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f780377dd90d33c8280734d882fc2ac9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC506.tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	f780377dd90d33c8280734d882fc2ac9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3304	2240	f780377dd90d33c8280734d882fc2ac9.exe	89
PID 2240 wrote to memory of 3304	2240	f780377dd90d33c8280734d882fc2ac9.exe	89
PID 2240 wrote to memory of 3304	2240	f780377dd90d33c8280734d882fc2ac9.exe	89
PID 3304 wrote to memory of 2316	3304	vbc.exe	91
PID 3304 wrote to memory of 2316	3304	vbc.exe	91
PID 3304 wrote to memory of 2316	3304	vbc.exe	91
PID 2240 wrote to memory of 5108	2240	f780377dd90d33c8280734d882fc2ac9.exe	92
PID 2240 wrote to memory of 5108	2240	f780377dd90d33c8280734d882fc2ac9.exe	92
PID 2240 wrote to memory of 5108	2240	f780377dd90d33c8280734d882fc2ac9.exe	92

C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe
"C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4cfwli3t\4cfwli3t.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC62E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc76AB46BAEFB34A8C9EB5C4C9B530BBBD.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2316
- C:\Users\Admin\AppData\Local\Temp\tmpC506.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC506.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f780377dd90d33c8280734d882fc2ac9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4cfwli3t\4cfwli3t.0.vb

Filesize
2KB

MD5
2ba2af8546c205bd91e8d4be035a7c98

SHA1
28667620549626a12a7ccc292bad99044725dde6

SHA256
42c87cec7a7a1b7b64a5aa07b244e1ff95de863a05c6ef9115d5ecd5e5e57a5b

SHA512
fdc8023d3ec402b594cf241a14e263491335f7b8ab5b1be815091c1167893321ee4f956c6b3010eb7e1cf3b1e59045da509af2495ba7070fc42d23541b359205

Download Submit
C:\Users\Admin\AppData\Local\Temp\4cfwli3t\4cfwli3t.cmdline

Filesize
273B

MD5
4528b61acf1b799def6ee28cb36848c9

SHA1
ca98f27a4f7c86a9afefd06df71687adab49ecd9

SHA256
064671a95a60541b5044a89bce5b0c31c401a29fdacb6d75097b0851a9295b12

SHA512
3bea290fdcdec5f61da133db3248ec5891e303d30519614359ad49001f4912ead7bf58cbcee054f886253cf5123f94db6ecb8bd30de979cdd4e6351d4f79910f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RE.resources

Filesize
2KB

MD5
f6176cd0f6b6565cad8b447e5a17a3ea

SHA1
93c10dc3a39b64d8ebdbf61118e3d70c41bcdf01

SHA256
cefe327bb2979572fa73c85f6b32ab5c853b952aff44b79cf3382c086430e100

SHA512
6db8e7b9c0cdb3b1fbbe6a8ccf4887b239937bdfb7057d86e082f9abe3972c5d05478109f192d9ebe35542123768ed34f23cdf12f1ddf343d7bc02d64f4d0789

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC62E.tmp

Filesize
1KB

MD5
c6f23e5af1e4e1facc8542e1c48bda1e

SHA1
07ab5eb5d25234274c64eb2cf26bf8c6c139d1d2

SHA256
9819af550f6cc47b95967bbf2c33ffac73f3c74cdb3c8c3b47c467134eb36282

SHA512
203da114577b6a36d7056d54b16d7112cb41d9b16b6afd9f0fc6c4cc35bf4cbfb82a537b1d6b5acb21c02267f3f0f5680330b707e21c6279e3497a9aa8a32821

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC506.tmp.exe

Filesize
12KB

MD5
7bef8171988c18749ec8a45129375f66

SHA1
a0a716053660556732d1ba9b4c52f787c108dd7f

SHA256
07f66b742cb2dbde58cf642f04f5ab900249fdd1963ad8b82a8ff72b0a545317

SHA512
374ed33e2a1e02b2ad827a985f8f67c02783036c4259e254eaeede724b42f10eaf08d477d75a39e4fd8d91e71ac22b3c5922fb21fa649baac544c2b7422d7c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc76AB46BAEFB34A8C9EB5C4C9B530BBBD.TMP

Filesize
1KB

MD5
5f797020b04c1c4945db14750cf4b5ab

SHA1
f8e143163f2c4435137d92f5ee3389ec1ff5d0e6

SHA256
36787f5818231ab1808f210d4a7709c7ddf3dcde0a3551558c9c3a33cd4a8353

SHA512
7b14dfab7e746383491533d1693b203cbdc4e7a7753b5a95c75647dd89c5e0c3e6d631bd8d7dd8fd44dc339f9b974ee987dc3837b4f46740acea8173892264d9

Download Submit
memory/2240-8-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/2240-2-0x00000000057B0000-0x000000000584C000-memory.dmp

Filesize
624KB

Download
memory/2240-1-0x0000000000D90000-0x0000000000D9A000-memory.dmp

Filesize
40KB

Download
memory/2240-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/2240-25-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/5108-24-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/5108-26-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/5108-27-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/5108-28-0x00000000055A0000-0x0000000005632000-memory.dmp

Filesize
584KB

Download
memory/5108-30-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download