ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc

Analysis

max time kernel
63s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe
Size

19KB
MD5

411261d546d6e49ff5946d4e548712f0
SHA1

de15aba9b0646e625063d67548eefc41cb079282
SHA256

ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc
SHA512

8a2528555240c89208406d1f4df20f0a47c2087496eb7127697767e5e483d32ec037d58a840d853ecb5320335832f0da0ccdb81f96af40f6c038bcd1c1937619
SSDEEP

384:Idu9LNL1QFars3y3bQpYZRDtY8alJZjLzuC:IM9LCWn8ZjL1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2288	realupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2288	4616	ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe	83
PID 4616 wrote to memory of 2288	4616	ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe	83
PID 4616 wrote to memory of 2288	4616	ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe	83

C:\Users\Admin\AppData\Local\Temp\ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe
"C:\Users\Admin\AppData\Local\Temp\ca92dbbaae72fc9140efd69e50a0558e126faf0234bd2385a0841820a64968bc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\realupdater.exe

Filesize
19KB

MD5
a48de35feee4cc7d1fb18e5b5247807d

SHA1
c9a55195dd75249fdb15ad3328099806869090e4

SHA256
114ceac590bc05463077476df26681b271e2476cb2db007657613e25621d39d9

SHA512
1be0f42688a7e98f3d03084f24df654d6544fa41c9a649f31644943dd09458862e2c00f9be1c8262644f624a8f653432b6bb3d87c52fac53dab1cb2d1c60987c

Download Submit
C:\Users\Admin\AppData\Local\Temp\realupdater.exe

Filesize
19KB

MD5
a48de35feee4cc7d1fb18e5b5247807d

SHA1
c9a55195dd75249fdb15ad3328099806869090e4

SHA256
114ceac590bc05463077476df26681b271e2476cb2db007657613e25621d39d9

SHA512
1be0f42688a7e98f3d03084f24df654d6544fa41c9a649f31644943dd09458862e2c00f9be1c8262644f624a8f653432b6bb3d87c52fac53dab1cb2d1c60987c

Download Submit
memory/2288-136-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4616-135-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download