0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe
Size

19KB
MD5

28b3d87d24f2fac5ccf2205c0fa93430
SHA1

9ab8d489576664e49b798f70252053722c7c0d24
SHA256

0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a
SHA512

ccc437b4189ee8439648394f2109c0bfd37c608e41c86e25ea58282f9bad5eaaab9dc77c01bc0f29ed39cd47cf93ade39a29d79d58ae820e40675ecf83d441ce
SSDEEP

384:Idu9LNL1QFars3y3bQpYZRDtY8alJZjLzu/vHfBy6:IM9LCWn8ZjL8PfBy6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4944	realupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4944	4364	0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe	78
PID 4364 wrote to memory of 4944	4364	0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe	78
PID 4364 wrote to memory of 4944	4364	0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe	78

C:\Users\Admin\AppData\Local\Temp\0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe
"C:\Users\Admin\AppData\Local\Temp\0131c05a93388e0595e99b9d7b78c4ae21dc0e1fd4b8b7ae3f6d85607a81db1a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\realupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\realupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\realupdater.exe

Filesize
19KB

MD5
dd24323a524f58c94fc669406f53d82d

SHA1
05bab447fa3830b407e8a8a4e7a2d54185bce7ec

SHA256
8c851e28c947210effb59740d04ead4a76178027e71cbf0ca24a15c0a5c84104

SHA512
b3daf833c6a68c75f5049462efa228e2a2b4d98d86044ee6a3b3ca1df1614f9044afd274f1d31428590c49f49cee68d3a9ad7edae76eaada9eabff5db7e00e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\realupdater.exe

Filesize
19KB

MD5
dd24323a524f58c94fc669406f53d82d

SHA1
05bab447fa3830b407e8a8a4e7a2d54185bce7ec

SHA256
8c851e28c947210effb59740d04ead4a76178027e71cbf0ca24a15c0a5c84104

SHA512
b3daf833c6a68c75f5049462efa228e2a2b4d98d86044ee6a3b3ca1df1614f9044afd274f1d31428590c49f49cee68d3a9ad7edae76eaada9eabff5db7e00e9d

Download Submit
memory/4364-132-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4944-136-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download