eb344e2b7c1ad9f905546ce9965d22856e2917f0f4c0f6937f3e90f4201dcf9f

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bc9b2ea8c2377exeexeexeex.exe
Size

39KB
MD5

3bc9b2ea8c2377d551449ced9110de37
SHA1

e070dc25c26902b215164dbc8471b84d0aacc75b
SHA256

eb344e2b7c1ad9f905546ce9965d22856e2917f0f4c0f6937f3e90f4201dcf9f
SHA512

7d5ef848dc52d4d900cfb86f89a4a00275192c9d0e23b2ddcd26246b2eabe7f8fd3d97f6d5bdb96c9740ab63a98e6b70bce7254dd14632851811dfac740fdd23
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaXKvu:V6QFElP6n+gMQMOtEvwDpjya0u

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	3bc9b2ea8c2377exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4376	3568	3bc9b2ea8c2377exeexeexeex.exe	85
PID 3568 wrote to memory of 4376	3568	3bc9b2ea8c2377exeexeexeex.exe	85
PID 3568 wrote to memory of 4376	3568	3bc9b2ea8c2377exeexeexeex.exe	85

C:\Users\Admin\AppData\Local\Temp\3bc9b2ea8c2377exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\3bc9b2ea8c2377exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
9e7344244f59c88c396d9707e40e275a

SHA1
d93c0604afd633b8cee97a35b24a3dc2e01f14c7

SHA256
c186c769ba4598373052f8493f201cf60c862c98a3796a2daf37ddf743fa6147

SHA512
9b89cbc33f92bb6e1944a234c754fe443f522ed88e06f42b900ea5778682968bdc35f84061104d6185ae9181b2926af59aad4e1b6f4de74544cc09c42f7f25f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
9e7344244f59c88c396d9707e40e275a

SHA1
d93c0604afd633b8cee97a35b24a3dc2e01f14c7

SHA256
c186c769ba4598373052f8493f201cf60c862c98a3796a2daf37ddf743fa6147

SHA512
9b89cbc33f92bb6e1944a234c754fe443f522ed88e06f42b900ea5778682968bdc35f84061104d6185ae9181b2926af59aad4e1b6f4de74544cc09c42f7f25f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
9e7344244f59c88c396d9707e40e275a

SHA1
d93c0604afd633b8cee97a35b24a3dc2e01f14c7

SHA256
c186c769ba4598373052f8493f201cf60c862c98a3796a2daf37ddf743fa6147

SHA512
9b89cbc33f92bb6e1944a234c754fe443f522ed88e06f42b900ea5778682968bdc35f84061104d6185ae9181b2926af59aad4e1b6f4de74544cc09c42f7f25f5

Download Submit
memory/3568-136-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/3568-137-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4376-152-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download