c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d

Analysis

max time kernel
175s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
Size

104KB
MD5

4088f73f994529c0659b64d3527e4e2c
SHA1

004865f5f5997b310f57a874a4b60b0516e8f2ee
SHA256

c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d
SHA512

217a197a19257bbb0f9a35c6f6c2c8f552bb3cca6c5b57b5d74c536ef8d90e6d046e058c78d4aa5e0011ca2d71e2b9b81dd14d88b48d98bfa4d589f1d5576112
SSDEEP

1536:3oRG81Ltl1wia5XY7wfVWEm/QD/btVXL2wqLFeRGJqJdJNJnJIJVPhQjiOBDXFpt:181BwF5XYkIEmI/btVb2wqYRGhy8ZoJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1132	buakeo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4584	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
1132	buakeo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1132	4584	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	80
PID 4584 wrote to memory of 1132	4584	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	80
PID 4584 wrote to memory of 1132	4584	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	80

C:\Users\Admin\AppData\Local\Temp\c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
"C:\Users\Admin\AppData\Local\Temp\c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\buakeo.exe
  "C:\Users\Admin\buakeo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\buakeo.exe

Filesize
104KB

MD5
921a5ab7a88fe3ec8ce3cd145f06b78a

SHA1
6c3005f47f66a5b8fc70d7728dc4af971d39fa0c

SHA256
9e70d98acc0bfa98abc3dfcabfbb2da1d24bf485ece3223e8fcc8df10b7ab518

SHA512
784afab9c28148a1d4637877049ba86d4717b8f0cf82ba68d6ec9badad4fb5f795fa16171e406829802c5f3730da1e2003abbeebbdc5b9096985a0038aa6d6d8

Download Submit
C:\Users\Admin\buakeo.exe

Filesize
104KB

MD5
921a5ab7a88fe3ec8ce3cd145f06b78a

SHA1
6c3005f47f66a5b8fc70d7728dc4af971d39fa0c

SHA256
9e70d98acc0bfa98abc3dfcabfbb2da1d24bf485ece3223e8fcc8df10b7ab518

SHA512
784afab9c28148a1d4637877049ba86d4717b8f0cf82ba68d6ec9badad4fb5f795fa16171e406829802c5f3730da1e2003abbeebbdc5b9096985a0038aa6d6d8

Download Submit