16b85b5b65e89a360ce08ce076c55e5b0dfa4b635c6962bce3e1e20c8c9a4b68

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc4b41ed482efexeexeexeex.exe
Size

90KB
MD5

3dc4b41ed482efb6a5ff7395b69debad
SHA1

27f30d427f9dff4d94ab009be374c1ac53ff2869
SHA256

16b85b5b65e89a360ce08ce076c55e5b0dfa4b635c6962bce3e1e20c8c9a4b68
SHA512

1462b5178901cc79e5eef4eaa202012cd66279694431470e142047ea358504c821e5ddb8ca5b84c7454133b3e0b8de13fa6b4b542d1b90a7a1f79206c4ddb1bb
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWLm/:V6a+pOtEvwDpjtl

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	3dc4b41ed482efexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
3036	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3036	3880	3dc4b41ed482efexeexeexeex.exe	84
PID 3880 wrote to memory of 3036	3880	3dc4b41ed482efexeexeexeex.exe	84
PID 3880 wrote to memory of 3036	3880	3dc4b41ed482efexeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\3dc4b41ed482efexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\3dc4b41ed482efexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
023aa1bd32012a6c0657bc821783f71f

SHA1
90ed5b7c58f2f3bcb33fd44da18b822ab538f31c

SHA256
d9e7ae4c9930160c62a39cde6c63e7679cc68d8a4dac062bf1d93bcd61c41e18

SHA512
de2e80b39c7f6ecc223af30c6455a48484a01708713f91b0e67fc18446b23f919971bfbc605ea1e44dfbd666600898d28b4bc2b555a144ad617adc93b873e0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
023aa1bd32012a6c0657bc821783f71f

SHA1
90ed5b7c58f2f3bcb33fd44da18b822ab538f31c

SHA256
d9e7ae4c9930160c62a39cde6c63e7679cc68d8a4dac062bf1d93bcd61c41e18

SHA512
de2e80b39c7f6ecc223af30c6455a48484a01708713f91b0e67fc18446b23f919971bfbc605ea1e44dfbd666600898d28b4bc2b555a144ad617adc93b873e0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
023aa1bd32012a6c0657bc821783f71f

SHA1
90ed5b7c58f2f3bcb33fd44da18b822ab538f31c

SHA256
d9e7ae4c9930160c62a39cde6c63e7679cc68d8a4dac062bf1d93bcd61c41e18

SHA512
de2e80b39c7f6ecc223af30c6455a48484a01708713f91b0e67fc18446b23f919971bfbc605ea1e44dfbd666600898d28b4bc2b555a144ad617adc93b873e0d7

Download Submit
memory/3036-149-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3880-133-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/3880-134-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download