c96be7f4a4b6f672faaeb87391b04632ed21be75d8038d467047893e580cef87

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b17986b733cf4exeexeexeex.exe
Size

77KB
MD5

6b17986b733cf4d3ea0f39c951a747b9
SHA1

494d61ff17cfbb5ce4d9486f547941a299c6700f
SHA256

c96be7f4a4b6f672faaeb87391b04632ed21be75d8038d467047893e580cef87
SHA512

355a2dbe611e07ceaa9b6bcfd114de371b027c76f009933755826d09fff80508fd1d83c9f060fdf51c0d8eedb021f0d0425a8b0826d8b21666eda48509c921b7
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yJYbf:V6QFElP6n+gMQMOtEvwDpjyaLccVNlCL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	6b17986b733cf4exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2404	3712	6b17986b733cf4exeexeexeex.exe	85
PID 3712 wrote to memory of 2404	3712	6b17986b733cf4exeexeexeex.exe	85
PID 3712 wrote to memory of 2404	3712	6b17986b733cf4exeexeexeex.exe	85

C:\Users\Admin\AppData\Local\Temp\6b17986b733cf4exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\6b17986b733cf4exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
98ddc99b740c633144ab024416edf053

SHA1
8c91347a56ce3453e444d9a954b66b1a712bc509

SHA256
d081ce49571b33f1bdaffce64b528b2c8aaf656cc18b056e14bd6cc785ba39a1

SHA512
54f82ec432bfda325f9d180c88daec4266e26c28077df266a1259ee132867ba9b7c52981596ba60b79f5c1b52bf999a3654d8adab3d53bcd1849eb008ac1cede

Download Submit
memory/2404-149-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3712-133-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/3712-134-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download