Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:56
Static task
static1
Behavioral task
behavioral1
Sample
e84e4da0f16e40521247870311efd7ac.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e84e4da0f16e40521247870311efd7ac.exe
Resource
win10v2004-20240611-en
General
-
Target
e84e4da0f16e40521247870311efd7ac.exe
-
Size
556KB
-
MD5
e84e4da0f16e40521247870311efd7ac
-
SHA1
30683171aae1e7dd7288e3b1ad7ef1fbde632365
-
SHA256
fa4da01ef3e3d6eca87a36ba135e9b2084461a68e975895bc57050f6ab472def
-
SHA512
0b763636a40bf7bb09521859db1b78ea205bc17a6fe685851a1dce8d3f64a101267c56f706742a7c2dab0e61709924126793853ffa3f84bb706145e6817dbb2b
-
SSDEEP
12288:VRSNhZBlfA8/C8sSoC+PZE9O2bJIC0fDNNr:VsfA8K8J+O93l0fZF
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
m40Qp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys" m40Qp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e84e4da0f16e40521247870311efd7ac.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation e84e4da0f16e40521247870311efd7ac.exe -
Executes dropped EXE 1 IoCs
Processes:
m40Qp.exepid process 4856 m40Qp.exe -
Drops file in Windows directory 2 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exedescription ioc process File created C:\Windows\SoftwareDistribution\Download\m40Qp.sys e84e4da0f16e40521247870311efd7ac.exe File created C:\Windows\SoftwareDistribution\Download\m40Qp.exe e84e4da0f16e40521247870311efd7ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exepid process 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe 2484 e84e4da0f16e40521247870311efd7ac.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
m40Qp.exepid process 4856 m40Qp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
m40Qp.exedescription pid process Token: SeSystemEnvironmentPrivilege 4856 m40Qp.exe Token: SeDebugPrivilege 4856 m40Qp.exe Token: SeLoadDriverPrivilege 4856 m40Qp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exedescription pid process target process PID 2484 wrote to memory of 4856 2484 e84e4da0f16e40521247870311efd7ac.exe m40Qp.exe PID 2484 wrote to memory of 4856 2484 e84e4da0f16e40521247870311efd7ac.exe m40Qp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e84e4da0f16e40521247870311efd7ac.exe"C:\Users\Admin\AppData\Local\Temp\e84e4da0f16e40521247870311efd7ac.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SoftwareDistribution\Download\m40Qp.exe"C:\Windows\SoftwareDistribution\Download\m40Qp.exe" -map C:\Windows\SoftwareDistribution\Download\m40Qp.sys2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SoftwareDistribution\Download\m40Qp.exeFilesize
260KB
MD5083c6c05ac5875d0b6e997e894ca07bc
SHA169d0116998e8a70db5852fccb86d45975ce88a9a
SHA25603aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
SHA512fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf