35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e

General

Target
35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe
Size 239KB
Sample260824-qmtsfstyev
SHA256 35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e
MD5 1fa3a0a537c893e7e47137c91a9176cd
SHA1 fbb0e0c054a426337ea541d52db33ec9790331a9
SHA512 3f39f1a8b067e5003f853930ecbcc0a3372bdb554d21d59877879ce514efbc3cdc9b1e817897dd851dfd49d4058822a8db0f7acccf5d5fad46f8529e75b9bb3c
SSDEEP 3072:WfFfHgTWmCRkGbKGLeNTBf3N9VWBbgP1AO0:Y5aWbksiNTBfJWBbgP1
TLSH
T187349013A2DE7DE6D0B116713B7793D6C32EEE144622C49FA3C82A16953E18376273D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4084	cmd.exe
4976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35DD37~1.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3996	PING.EXE
896	PING.EXE
3836	PING.EXE
216	PING.EXE
3184	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
3996	PING.EXE
896	PING.EXE
3836	PING.EXE
216	PING.EXE
3184	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4228	35DD37~1.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4084	4708	35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe	87
PID 4084 wrote to memory of 536	4084	cmd.exe	88
PID 4084 wrote to memory of 4548	4084	cmd.exe	89
PID 4084 wrote to memory of 4496	4084	cmd.exe	90
PID 4084 wrote to memory of 4508	4084	cmd.exe	91
PID 4508 wrote to memory of 4228	4508	mshta.exe	92
PID 4228 wrote to memory of 4976	4228	35DD37~1.EXE	95
PID 4976 wrote to memory of 1232	4976	cmd.exe	96
PID 4976 wrote to memory of 3996	4976	cmd.exe	97
PID 4976 wrote to memory of 3320	4976	cmd.exe	98
PID 4976 wrote to memory of 896	4976	cmd.exe	99
PID 4976 wrote to memory of 1432	4976	cmd.exe	100
PID 4976 wrote to memory of 3836	4976	cmd.exe	102
PID 4976 wrote to memory of 1888	4976	cmd.exe	103
PID 4976 wrote to memory of 216	4976	cmd.exe	104
PID 4976 wrote to memory of 208	4976	cmd.exe	105
PID 4976 wrote to memory of 3184	4976	cmd.exe	106
PID 4976 wrote to memory of 3820	4976	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe
"C:\Users\Admin\AppData\Local\Temp\35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B1E6.tmp\B1E7.tmp\B1E8.bat C:\Users\Admin\AppData\Local\Temp\35dd3785c8813d82095095509e9cc329dbb72fc14a33dd1e06a51dc2c20ed38e.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\mode.com
    mode con cols=100 lines=30
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    PID:4548
- - C:\Windows\system32\find.exe
    find "5."
    3⤵
    PID:4496
- - C:\Windows\system32\mshta.exe
    mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\AppData\Local\Temp\35DD37~1.EXE","goto :UAC","","runas",1)(window.close)
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\35DD37~1.EXE
      "C:\Users\Admin\AppData\Local\Temp\35DD37~1.EXE" goto :UAC
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B59F.tmp\B5A0.tmp\B5A1.bat C:\Users\Admin\AppData\Local\Temp\35DD37~1.EXE goto :UAC"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Windows\system32\mode.com
        
        mode con cols=100 lines=30
        6⤵
        
        PID:1232
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 kms.ghpym.com
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3996
      - C:\Windows\system32\find.exe
        
        find "??"
        6⤵
        
        PID:3320
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 kms.ghpym.com
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:896
      - C:\Windows\system32\find.exe
        
        find "????"
        6⤵
        
        PID:1432
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 kms.ghpym.com
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3836
      - C:\Windows\system32\find.exe
        
        find "????"
        6⤵
        
        PID:1888
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 kms.ghpym.com
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:216
      - C:\Windows\system32\find.exe
        
        find "??"
        6⤵
        
        PID:208
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 kms.ghpym.com
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3184
      - C:\Windows\system32\find.exe
        
        find "???"
        6⤵
        
        PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B1E8.bat

Path C:\Users\Admin\AppData\Local\Temp\B1E6.tmp\B1E7.tmp\B1E8.bat
Size 20KB
SHA256 ac241d26da13e460f489963a0c02e1cd5ac653fd41c7e3e42cef75c683ef953e
MD5 d6eefcb693401f8e38de7c7dba3b9bb1
SHA1 16045af01e0ce58845e221ce848deb19660e6754
SHA512 2c2632eb6ef4dd79b6cbe6b0df2f1985166032ee18c073f10c879f489b56996049c0ff54e9e75197fe1cf99212a0e92a4c99705241e8ef8e0d9cfa4e0577c6aa
SSDEEP 384:9nXfCq7i+OMVKHvhs0CKsztvwYobee1XGSa0Lpb+UbRkBdsu/l9q8J/mYwjiqU1F:JyvXs5r0LcB5
TLSH
T1DB922229EE57909A102A9D07B8744909F3E096CB0947F88C715F42355F4ABCEF6DF4E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4708-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing