d46e663968823798523ece2e0feaeb7d466a1eb1fb579eba4df2fa1d2bf3f734

General

Target
0b198a9c8626d3da97de738ed3b11152.exe
Size 533KB
Sample220926-kd568sbcbn
SHA256 d46e663968823798523ece2e0feaeb7d466a1eb1fb579eba4df2fa1d2bf3f734
MD5 0b198a9c8626d3da97de738ed3b11152
SHA1 75d31ade268e71c9b007c521d5b46b3f411f3ed4
SHA512 15a0fc4593452e884f115e767a86427473d34572bcb0fc2564d7f28fe81fbc7c37fb792dc5e331f436e8e84df45db6ea140bee6367e8bf75041b83bc9efe72eb
SSDEEP 6144:8mNShJFAFanl5ekTOmc+kLWe2Ick3aMc7KLStLtEV8LobS6Hz2XPPnH84nY4cSYp:d65ekT3Tszck3aMc7OALo7HUNY+z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
964	asupen.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2228	0b198a9c8626d3da97de738ed3b11152.exe
2228	0b198a9c8626d3da97de738ed3b11152.exe
3364	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	0b198a9c8626d3da97de738ed3b11152.exe
Token: SeDebugPrivilege	3364	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2080	2228	0b198a9c8626d3da97de738ed3b11152.exe	96
PID 2228 wrote to memory of 2080	2228	0b198a9c8626d3da97de738ed3b11152.exe	96
PID 2228 wrote to memory of 2080	2228	0b198a9c8626d3da97de738ed3b11152.exe	96
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 2228 wrote to memory of 3364	2228	0b198a9c8626d3da97de738ed3b11152.exe	97
PID 3364 wrote to memory of 964	3364	RegAsm.exe	100
PID 3364 wrote to memory of 964	3364	RegAsm.exe	100
PID 3364 wrote to memory of 964	3364	RegAsm.exe	100
PID 3364 wrote to memory of 5012	3364	RegAsm.exe	102
PID 3364 wrote to memory of 5012	3364	RegAsm.exe	102
PID 3364 wrote to memory of 5012	3364	RegAsm.exe	102
PID 5012 wrote to memory of 4216	5012	cmd.exe	104
PID 5012 wrote to memory of 4216	5012	cmd.exe	104
PID 5012 wrote to memory of 4216	5012	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\0b198a9c8626d3da97de738ed3b11152.exe
"C:\Users\Admin\AppData\Local\Temp\0b198a9c8626d3da97de738ed3b11152.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe"
    3⤵
    - Executes dropped EXE
    PID:964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" && /C choice /C Y /N /D Y /T 3 & Del "shfolder.dll" && Del LAG1 && Del LAG2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asupen.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

asupen.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asupen.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/964-143-0x0000000000D90000-0x0000000000DA2000-memory.dmp

Download

memory/2228-133-0x0000000005990000-0x0000000005F34000-memory.dmp

Download

memory/2228-134-0x0000000005480000-0x0000000005512000-memory.dmp

Download

memory/2228-135-0x0000000005420000-0x000000000542A000-memory.dmp

Download

memory/2228-132-0x00000000009E0000-0x0000000000A6C000-memory.dmp

Download

memory/3364-138-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads