edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02

Analysis

max time kernel
51s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2023 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe
Size

978KB
MD5

bade1d7273254a6a30e79cea1c630664
SHA1

a163ef23f640c77714e3e58522f610937c86722e
SHA256

edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02
SHA512

486033e0666ccc4eb1ccefee614622d993f7d264e48872b157f73228dd2ddaf7386dc814a91839b2dcacbb68c4b5f85cdbb34eb0ac11a1e2ee8fef3cf40f04d8
SSDEEP

24576:iqd3Wqy5ZH2u7VyIb8NjMg2DjozicfyGmALYNsOPzmjHtX:iqRDQZH2u7db8NjFyEzicc3sYzmjHV

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Control Panel\International\Geo\Nation	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe

Executes dropped EXE 1 IoCs

Processes:

DriverGenius.exe

pid process

4572 DriverGenius.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2148 regedit.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DriverGenius.exe

pid process

4572 DriverGenius.exe

pid	process
4572	DriverGenius.exe

pid	process
2148	regedit.exe

pid	process
4572	DriverGenius.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe

description	pid	process	target process
PID 4900 wrote to memory of 2148	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	regedit.exe
PID 4900 wrote to memory of 2148	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	regedit.exe
PID 4900 wrote to memory of 2148	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	regedit.exe
PID 4900 wrote to memory of 4572	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	DriverGenius.exe
PID 4900 wrote to memory of 4572	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	DriverGenius.exe
PID 4900 wrote to memory of 4572	4900	edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe	DriverGenius.exe

C:\Users\Admin\AppData\Local\Temp\edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe
"C:\Users\Admin\AppData\Local\Temp\edb888c2bc2c70a87534921e30d0cd1fecabc47721f3c9e142bf1ef0b03cbd02.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s regGB.reg
2⤵
- Runs .reg file with regedit
PID:2148

C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe
"C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE
Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE
Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe
Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\regGB.reg
Filesize
1KB

MD5
b9c2108bc717726aca52271ae5b35134

SHA1
c861ed81d7603d03519abf1ea771feae7218b392

SHA256
f59ae1bc8976939fd78fd7b9a6fb9d97d52803aa6625f313be1c0138c4c991dd

SHA512
2fe853df320926f3ac2d72a39fb93ee4d1c6c82ac066f637318e2477b0170b9b0567b0b8da6e09c392ba42e21b44e8f20c3c1c76e84ed7015c29b26b9c388cfa

Download Submit
memory/4572-159-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/4900-133-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4900-134-0x0000000000030000-0x0000000000032000-memory.dmp

Filesize
8KB

Download
memory/4900-156-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download