99a8e6ecf9bbea7d906e154d5fc699051645d5efc3c6319a2b45513f64589efc

General

Target
Key Generator.exe
Size 31.1MB
Sample251007-yd535askz3
SHA256 52ef16c62ea7ef46c2187a08cf618d989a514bdab8e452777fc76f57d45ba033
MD5 7331003634b9ba117fdc644911c1983f
SHA1 23a86779b0c77991f21ad93595209e2c502296af
SHA512 cd6ebe9f2763662adb896b38d089f7d9c936acbf22c291ed83c7691b1bfbb07dd4e0387dbe84e1f302c74b23bb94e7e00843bf86040bb4ab3e2e69133472961b
SSDEEP 49152:fkZQiO0OSf4t9KVsC2kd+z/kHcPO6FVSOzdtoe3bxqsfrFuWrFuYTX8uTMdCn69e:fkZQb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\Control Panel\International\Geo\Nation	Key Generator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\Control Panel\International\Geo\Nation	Key Generator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\Control Panel\International\Geo\Nation	Key Generator.exe

Executes dropped EXE 3 IoCs

pid	Process
5320	Server.exe
5132	Server.exe
2920	Server.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe"	Key Generator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe"	Key Generator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Key Generator.exe2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Key Generator.exe"	Key Generator.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Key Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Key Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Key Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Key Generator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3708	Key Generator.exe
5844	Key Generator.exe
2100	Key Generator.exe
1208	Key Generator.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 5320	3708	Key Generator.exe	84
PID 3708 wrote to memory of 5320	3708	Key Generator.exe	84
PID 3708 wrote to memory of 5320	3708	Key Generator.exe	84
PID 3708 wrote to memory of 5844	3708	Key Generator.exe	86
PID 3708 wrote to memory of 5844	3708	Key Generator.exe	86
PID 3708 wrote to memory of 5844	3708	Key Generator.exe	86
PID 5844 wrote to memory of 5132	5844	Key Generator.exe	88
PID 5844 wrote to memory of 5132	5844	Key Generator.exe	88
PID 5844 wrote to memory of 5132	5844	Key Generator.exe	88
PID 5844 wrote to memory of 2100	5844	Key Generator.exe	89
PID 5844 wrote to memory of 2100	5844	Key Generator.exe	89
PID 5844 wrote to memory of 2100	5844	Key Generator.exe	89
PID 2100 wrote to memory of 2920	2100	Key Generator.exe	90
PID 2100 wrote to memory of 2920	2100	Key Generator.exe	90
PID 2100 wrote to memory of 2920	2100	Key Generator.exe	90
PID 2100 wrote to memory of 1208	2100	Key Generator.exe	91
PID 2100 wrote to memory of 1208	2100	Key Generator.exe	91
PID 2100 wrote to memory of 1208	2100	Key Generator.exe	91

C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
"C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5320
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    PID:2924
- C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
  "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
    "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
      "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        6⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        8⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        9⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        9⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        10⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        10⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        11⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        11⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        12⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        12⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        13⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        13⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        14⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        14⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        15⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        15⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        16⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        16⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        17⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        17⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Server.exe"
        18⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Key Generator.exe"
        18⤵
        
        PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Key Generator.exe
1⤵
PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\svchost.exe" ..
1⤵
PID:752
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe ..
  2⤵
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log
Size 408B
SHA256 b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
MD5 42157868488d3ef98c00e3fa12f064be
SHA1 aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA512 8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
MD5 SHA1 SHA512

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 43KB
SHA256 7a4bb80b4a9935bccd20093287af8fea0657de33f35365d5f092468f55cb4326
MD5 cb91454b0779457448a14b0d02c159b0
SHA1 05d4523a90cb97db6aebe53e2c6e9b75138ca8a0
SHA512 40aa7184dcbf3414e09bc2605953829b351c9039c0f424b76778b0551c0fb4d189e456711df8c5c8356af3c86b20c0d965540fc76e484b3ae76496e4e46eeb77
SSDEEP 384:zZyViERFAJ2HytDUmDgwMMzXUo8qpY/u9D9O5UE5QzwBlpJNakkjh/TzF7pWnuUR:9k52oStgm0YIzqCvQO+rUJ+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5320-11-0x0000000073822000-0x0000000073824000-memory.dmp

Download

memory/5320-10-0x0000000000540000-0x0000000000550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads