a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148

Analysis

max time kernel
189s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe
Size

11KB
MD5

22fa2cb1268915e211b89c67e2460260
SHA1

5ee904c5d0698f35a21b3452db7d461b066e5563
SHA256

a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148
SHA512

199f2a2cf4cb9192bff54449f0ff7d3f6073a9b4ddef2c74ebb272027aed367916c49ce17a74b19f5601ca49ea26948513eb6980c07c237d0c1b90fcdc8eb1d7
SSDEEP

96:AiTtNiT2BgbALDlLI7g4w0H1zeEjicuI/1bE4j2+ISCGu+AzwsOl8KCqaabh+u0z:AiY2Rwocok1FhIXGNAzy8GUuhwMY

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
384	trueupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 384	5000	a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe	84
PID 5000 wrote to memory of 384	5000	a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe	84
PID 5000 wrote to memory of 384	5000	a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe	84

C:\Users\Admin\AppData\Local\Temp\a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe
"C:\Users\Admin\AppData\Local\Temp\a23b8bdebc162c2940c60102834336bb823e43d49ede46214c32fc0dcb909148.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\trueupdater.exe

Filesize
11KB

MD5
77729ec2018f05c9008889649cf1e54b

SHA1
7290c977fb77412f4ebe6823e9b4f1eab7101b5e

SHA256
1268628e73e150cfe214760e8817d9c15eb510bd3f240f6395593bf94cd784ca

SHA512
1a1efe6a27b97c4187a86d15bc5840f880ac7a5010aa3d98d9bd33bc672aa36e3152011fe4067a9e2ff1db289db04766ee1a9eda9030878881abec00a0f23820

Download Submit
C:\Users\Admin\AppData\Local\Temp\trueupdater.exe

Filesize
11KB

MD5
77729ec2018f05c9008889649cf1e54b

SHA1
7290c977fb77412f4ebe6823e9b4f1eab7101b5e

SHA256
1268628e73e150cfe214760e8817d9c15eb510bd3f240f6395593bf94cd784ca

SHA512
1a1efe6a27b97c4187a86d15bc5840f880ac7a5010aa3d98d9bd33bc672aa36e3152011fe4067a9e2ff1db289db04766ee1a9eda9030878881abec00a0f23820

Download Submit