10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a

Analysis

max time kernel
115s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe
Size

110KB
MD5

1219fd92b856af801222a81847144bd1
SHA1

1c70af841e3a44a625d5b010d94a7f1691fa8a22
SHA256

10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a
SHA512

26ee83d1d545b455227781da74fa43459047b36b301bd7e9fe96cf1008279d2f3ae88ef46f227b63af73bce79b4024e42ab7cf581ad0d36fa3409d25385f54f9
SSDEEP

1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan2/MI:hMGh1Ja1q3L9qfHIDbJNvV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4964	3232	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	83
PID 3232 wrote to memory of 4964	3232	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	83
PID 3232 wrote to memory of 4964	3232	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	83

C:\Users\Admin\AppData\Local\Temp\10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe
"C:\Users\Admin\AppData\Local\Temp\10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bgp..bat" > nul 2> nul
  2⤵
  PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bgp..bat

Filesize
274B

MD5
375a2a41f8e9fd540a67dd9182394f48

SHA1
f6dad3b97481676df7ca6ea34afb5dfcf949b0c8

SHA256
7d136d74e2eecebe59ce542ca64a047dadfa18acbeed9931ac0bc6b90b475244

SHA512
6343532a178b4509d0bd5851c0db4ae053447af290a506ed8a86056c6c361ac96d2ef7321cb22af82c752d4930a6482d5d5a4992209f267e3cc7336dc31a054c

Download Submit
memory/3232-133-0x00000000001D0000-0x00000000001E7000-memory.dmp

Filesize
92KB

Download
memory/3232-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download