892c47720067aeba15e34a01c99bdca1bab885ab71772ee0dde70380261b64b4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5471cb3a0b120dexeexeexeex.exe
Size

46KB
MD5

5471cb3a0b120d8872f2bac62b222323
SHA1

71250c1835bf487263614437348900cd75274be8
SHA256

892c47720067aeba15e34a01c99bdca1bab885ab71772ee0dde70380261b64b4
SHA512

9dab9a69bff56897da0d8400a0f84d70a332ff85db401013202143ac620791e6f24d0a2abeae8dda7f06ea0f442daac32ba619b1d845a045302cd93a5a105b21
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4Uu6EIZPm8M:bIDOw9a0DwitDwIZbM

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	5471cb3a0b120dexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
2496	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2496	2944	5471cb3a0b120dexeexeexeex.exe	84
PID 2944 wrote to memory of 2496	2944	5471cb3a0b120dexeexeexeex.exe	84
PID 2944 wrote to memory of 2496	2944	5471cb3a0b120dexeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\5471cb3a0b120dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\5471cb3a0b120dexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
46KB

MD5
bb8bc0f92285144661e5ac33b743459f

SHA1
c75e3759473be0c6dad0df52f2cf7da82cb9699c

SHA256
ad9e01827992a4293cd734db5fe501452a723ee50d304886d4be38b12738a196

SHA512
a549405bc69994d3c4cb83c98810b7b905462283640ed4a6cf515426f4030ac00fcdc6697848eee9059d11c3ddad96f03f0638b8038525e728b130478cac114c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
46KB

MD5
bb8bc0f92285144661e5ac33b743459f

SHA1
c75e3759473be0c6dad0df52f2cf7da82cb9699c

SHA256
ad9e01827992a4293cd734db5fe501452a723ee50d304886d4be38b12738a196

SHA512
a549405bc69994d3c4cb83c98810b7b905462283640ed4a6cf515426f4030ac00fcdc6697848eee9059d11c3ddad96f03f0638b8038525e728b130478cac114c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
46KB

MD5
bb8bc0f92285144661e5ac33b743459f

SHA1
c75e3759473be0c6dad0df52f2cf7da82cb9699c

SHA256
ad9e01827992a4293cd734db5fe501452a723ee50d304886d4be38b12738a196

SHA512
a549405bc69994d3c4cb83c98810b7b905462283640ed4a6cf515426f4030ac00fcdc6697848eee9059d11c3ddad96f03f0638b8038525e728b130478cac114c

Download Submit
memory/2496-149-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2944-133-0x00000000022E0000-0x00000000022E6000-memory.dmp

Filesize
24KB

Download
memory/2944-134-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download