3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe
Size

121KB
MD5

1da6f6201e7d99822b24d1c5aec136dd
SHA1

555d5e6a8f869f823dcd98c86e2a1fb52c99c22d
SHA256

3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70
SHA512

13c243ab1b6a617b4957ca2a97c3bb5275ca5f625c4ca8517658c452ae1f0ea5cbf0f49599f18c349e37462fcb47213655126f2bbc0902a498b0054dc75a9eaf
SSDEEP

3072:4NKfRBKVL6V+kr9d+TpvDbTDp1BssMWAPZLna+nF:4AfG4VX+TpHHiTZuu

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4332	3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4032-132-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/files/0x0006000000022e30-134.dat	upx
behavioral2/files/0x0006000000022e30-135.dat	upx
behavioral2/memory/4032-136-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4332-137-0x0000000000400000-0x0000000000439000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4332	4032	3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe	84
PID 4032 wrote to memory of 4332	4032	3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe	84
PID 4032 wrote to memory of 4332	4032	3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe	84

C:\Users\Admin\AppData\Local\Temp\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe
"C:\Users\Admin\AppData\Local\Temp\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\Temp\MT\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe
  "C:\Windows\Temp\MT\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe"
  2⤵
  - Executes dropped EXE
  PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\MT\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe

Filesize
91KB

MD5
cda84ccd744dd16fabd7c7c508f192f4

SHA1
0c88b1cec1246677504ca11322882a8fc2bffa9e

SHA256
f207f1d04fce46198f7512dc5e7625939e1b519ce521a1302cca4343607bc98c

SHA512
49ebb0ce77cc3890b10a6ab627b99be4a8e76ca31c8454dc88c685369e48c91b98fe034b510689a035663210b59245bdf12c23dcc0bb721f32633ce1f2271ce6

Download Submit
C:\Windows\Temp\MT\3323b5448736a227b1988182550cebc9d712c834e963073cf2ac65c6c1cb6e70.exe

Filesize
91KB

MD5
cda84ccd744dd16fabd7c7c508f192f4

SHA1
0c88b1cec1246677504ca11322882a8fc2bffa9e

SHA256
f207f1d04fce46198f7512dc5e7625939e1b519ce521a1302cca4343607bc98c

SHA512
49ebb0ce77cc3890b10a6ab627b99be4a8e76ca31c8454dc88c685369e48c91b98fe034b510689a035663210b59245bdf12c23dcc0bb721f32633ce1f2271ce6

Download Submit
memory/4032-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4032-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4332-133-0x0000000000000000-mapping.dmp

Download
memory/4332-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download