6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687

General

Target
_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
Size 10KB
Sample260507-pca2xsds41
SHA256 6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687
MD5 f3e913df14f4da32a99c1fb61ef06e7c
SHA1 24463d71b1d5a901759a7a0b7dda304a3163830d
SHA512 fca8da43f508b2d56347591acc09ef6b049533424d732fdec25af4a0acbc761b50694c4682e07295cc826d855ca0927820199521f9727c400e1c640f6271d844
SSDEEP 96:7BOdVoGYz/J4hvFDBWdCaD4DbFx+ZQnBpsTVwNYspKPFJxGE9mZ2FFhxC7tCEore:Vwo1wFDBFx+enfNKPFJxTEZmFhSor
TLSH
T1BD22FA197E4A4331D3A089F81875834B553D2663E783E3EFF373959A4A653484C41E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
6	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe

Executes dropped EXE 7 IoCs

pid	Process
5092	3411913223.exe
4296	2278728173.exe
2612	1902539501.exe
1540	961717144.exe
4820	3977825069.exe
1704	2906316153.exe
5272	2256226714.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	961717144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3977825069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2906316153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2256226714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3411913223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2278728173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1902539501.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 5092	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	84
PID 3920 wrote to memory of 4296	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	85
PID 3920 wrote to memory of 2612	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	86
PID 3920 wrote to memory of 1540	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	87
PID 3920 wrote to memory of 4820	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	97
PID 3920 wrote to memory of 1704	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	98
PID 3920 wrote to memory of 5272	3920	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	99

C:\Users\Admin\AppData\Local\Temp\_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
"C:\Users\Admin\AppData\Local\Temp\_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\3411913223.exe
  C:\Users\Admin\AppData\Local\Temp\3411913223.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5092
- C:\Users\Admin\AppData\Local\Temp\2278728173.exe
  C:\Users\Admin\AppData\Local\Temp\2278728173.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\1902539501.exe
  C:\Users\Admin\AppData\Local\Temp\1902539501.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\961717144.exe
  C:\Users\Admin\AppData\Local\Temp\961717144.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\3977825069.exe
  C:\Users\Admin\AppData\Local\Temp\3977825069.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\2906316153.exe
  C:\Users\Admin\AppData\Local\Temp\2906316153.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\2256226714.exe
  C:\Users\Admin\AppData\Local\Temp\2256226714.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1902539501.exe

Path C:\Users\Admin\AppData\Local\Temp\1902539501.exe
Size 19KB
SHA256 ff4f9c8e990c7a1b48fc286c47c442cd4bf151e1f0323d3eb86af26a3c749414
MD5 cde12373a968cbb890166e33dfd48686
SHA1 b08f6699a3cfc33b09d79c0454d868d2ba0a28a0
SHA512 d904892eb35a5b7391febec939bafa63c53e3c18db6e36123748ed631b2d1c456dd962ffdfa7203d1f13186abb52e2321361402991362463641f0949cd138031
SSDEEP 384:RIkjLVlvaZLhjTB1wtg0lu9NH0rFZDTNav8U9cqG:92L9tD0g9+a0UDG
TLSH
T176925B0FFA908316D1D1047456A24B7FD6B99876338454EFF7C886CA0B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2256226714.exe

Path C:\Users\Admin\AppData\Local\Temp\2256226714.exe
Size 19KB
SHA256 b75c9acb2ca883c930191fb7f20422bd2ec48d029a58beec591f00318ce838ed
MD5 b7a68e1055593dbcf0cb10c873cf845b
SHA1 bf23648382b728944c8bc1bf6f87d98275bf0f6c
SHA512 c9b4f5d140fbbf3d213927f43a05e3c1465167e2f8650f236e82d2c6ed7c7cb46fc8340e978095d028e37b4969fd921c78a0076af7c3e9d68916748eae4bc2bc
SSDEEP 384:AIkjLVlvaZLhjTB1wtg0lu9NH0rjDDTNav8U9c0G:U2L9tD0g9+a0UJG
TLSH
T1E8925B0FFA948316D1C0047496A24B3FD5799876338454EFF7C886CA0B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2278728173.exe

Path C:\Users\Admin\AppData\Local\Temp\2278728173.exe
Size 19KB
SHA256 733f4abb59577e459509b7ac26c3c8d395ca2c3a8a9ed9f5f6c5a7eb4549b251
MD5 0ccbea8573c7ba4cba51e9ea139926bb
SHA1 2e8fd884b4319c0aebe938aea395f627fe68557a
SHA512 2218c11fb45799f2f85dbe41b189ab17b7fb0994b0769f3ddb98d76fc1ce8b18047b9768f5420c064ea7205267c538d05fe8fc0dc42a8d35f1a557124464ed4b
SSDEEP 384:eIkj7VlvaZLRzjBVwRwSZlu9NH0rFZDTdav8U9ctG:umLd9fUg9Oa0U8G
TLSH
T178925B0FBA548316D1D0047466A64B7FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2603535258.exe

Path C:\Users\Admin\AppData\Local\Temp\2603535258.exe
Size 11KB
SHA256 23c967b48237193d25e717942d38f5db2fc9c8650aefb96a23f1ff294e67af77
MD5 92719b946f566b66d2a92e403a1ec601
SHA1 f7a2568fb304433431de98a1bc5d7cda11f67c8c
SHA512 214333e5b7a826461dcf2c04245e8d0097ec5a061281dc53afe871e568197687aff6c58d4348591cc7e9db10739dad76463acfd46f554c1bbda43abce1d73c35
SSDEEP 192:fY1SCngTBvkj7Vlv/iZuSQ/Iz6QUajpwRWXlgZKF1KUSvu9zwwHFQ:MIkj7VlvaZLRzjBVwRwSZlu9NHy
TLSH
T1D042060FF990832AE5C140B496664B3FDA7598B5338090D7E7E88AD6517CAE2F43744F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2906316153.exe

Path C:\Users\Admin\AppData\Local\Temp\2906316153.exe
Size 19KB
SHA256 69c1077c17e91680304fcc397ded72824bc24161bffd8efca86c29ba9221d198
MD5 6c58fb4f988d797bceb6f1070973d028
SHA1 63eb33d403a3767171e4521c3df0afbe8f61cd2c
SHA512 ce0eeb6fb11925274f8f7a0ee37ba6eb632391b6b5df21c71504b12863d49db3d4f6b99a777d68fc069483db43dabc43da4eb76fce900912d8213bd83f05fad8
SSDEEP 384:BIkjrVlvaZLBDzB1wZov0lu9NH0rFZDTtav8U9cZG:tWL9Nfv0g9ea0UsG
TLSH
T18D924B0BBA548316D1D0007466A24B3FD67998B6338454EFFBD889CA1B682E6F83255F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3411913223.exe

Path C:\Users\Admin\AppData\Local\Temp\3411913223.exe
Size 19KB
SHA256 235e842f2b22ca59648111919a0df1a4fae1301d94ae818a3fe35bcb42d56cdc
MD5 e051956c888f4d41f17c89e88be96bb6
SHA1 30087c2865e58a18f622aa39d6d7c93ddcbba4c7
SHA512 c1c9948ae75d80170ecf1c9b8b80963ced8d03f86b1b3a3878bf0e00f969f50b836b65b58feb1da7b2376d12c40af5f07a82a2d96be7267213110d1dedebb5d7
SSDEEP 384:mIkjLVlvaZLhjTB1wtg0lu9NH0rFZDTNav8U9cnG:W2L9tD0g9+a0UuG
TLSH
T157925B0FFA948316D1C1047456A28B3FD6B99876338454EFF7C886CA1B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3977825069.exe

Path C:\Users\Admin\AppData\Local\Temp\3977825069.exe
Size 19KB
SHA256 ec523e453bc03e97c54c7510186c34f1b0a787ca16ff1b036c523efc64ec4ec4
MD5 36c9b7687a9c125c8a0f6a5c80062b0e
SHA1 9d24134df47b53d4cc00667808c3c5b32f5fb91c
SHA512 6603ca4ff71e5652e698cfcafa7a9a4848938a01472a446e9018f97a0e48b2a2412def8421dd80e8c6b29c5234af5bfec1c5159b4a641e9a80ca1e4832b49a65
SSDEEP 384:MIkj7VlvaZLRzjBVwRwSZlu9NH0rFZDTdav8U9cPG:wmLd9fUg9Oa0UuG
TLSH
T111925C0FBA544316D1D0047466A6477FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

961717144.exe

Path C:\Users\Admin\AppData\Local\Temp\961717144.exe
Size 19KB
SHA256 f7bf3149d776cb837ffe394f2f30111d814f23049800b3355441f52c30da17a0
MD5 dfefbb63a94c52e06b1444041503dfd6
SHA1 497f516327f71f90c95b600a4daf34b839005038
SHA512 510c9702b14d01440e01ed1df0bd32a840077e6ea01ff143ad873043335b5c8ebd4a845a5ef456dad12e1cb8a8697261cc8c8a50844d45bc12ef2977ccdc1923
SSDEEP 384:UIkj7VlvaZLRzjBVwZwSZlu9NH0rFZDTdav8U9cFG:YmLd93Ug9Oa0UsG
TLSH
T12D925C0FBA548316D1D00474A6A6477FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads