cdc614efebaf763f0105cf05e1ebc205c93bab364448f3fb1645ecd2cb7536fc

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64cc61ca5c389bexeexeexeex.exe
Size

45KB
MD5

64cc61ca5c389bfc2f9745cbe8db54f6
SHA1

ae50e32f86d306fe0ce638c5013b28fe22756826
SHA256

cdc614efebaf763f0105cf05e1ebc205c93bab364448f3fb1645ecd2cb7536fc
SHA512

750ed818c033d68cb8ae2e560358702677e1fce6cf22f032757e7f28d1f05edd164db988a87d46369cb2643831e66bad63a117b63b8bfe04e138d1b6bdc7213c
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKdtGrP+bY/qxSIOMlb9:79mqyNhQMOtEvwDpjBxIOMlp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	64cc61ca5c389bexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3628	4732	64cc61ca5c389bexeexeexeex.exe	82
PID 4732 wrote to memory of 3628	4732	64cc61ca5c389bexeexeexeex.exe	82
PID 4732 wrote to memory of 3628	4732	64cc61ca5c389bexeexeexeex.exe	82

C:\Users\Admin\AppData\Local\Temp\64cc61ca5c389bexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\64cc61ca5c389bexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
b4a582ae24e633f6df7078fe46477b6f

SHA1
a6c482acd8cfb84895db264af266c64ec3c751ff

SHA256
4449f32d50a6ab5adff76d8f9f95d1a764f7b8c20c5993ac6e4f9d10ff5219f0

SHA512
f79a0bec4349c3c0d0cc676eec1c8fd94dcb447d7090b36505d5e5022d69e020c945a36196575b6a3c4e943d4744c62f63589140cd47eb079c6fc091787380b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
b4a582ae24e633f6df7078fe46477b6f

SHA1
a6c482acd8cfb84895db264af266c64ec3c751ff

SHA256
4449f32d50a6ab5adff76d8f9f95d1a764f7b8c20c5993ac6e4f9d10ff5219f0

SHA512
f79a0bec4349c3c0d0cc676eec1c8fd94dcb447d7090b36505d5e5022d69e020c945a36196575b6a3c4e943d4744c62f63589140cd47eb079c6fc091787380b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
b4a582ae24e633f6df7078fe46477b6f

SHA1
a6c482acd8cfb84895db264af266c64ec3c751ff

SHA256
4449f32d50a6ab5adff76d8f9f95d1a764f7b8c20c5993ac6e4f9d10ff5219f0

SHA512
f79a0bec4349c3c0d0cc676eec1c8fd94dcb447d7090b36505d5e5022d69e020c945a36196575b6a3c4e943d4744c62f63589140cd47eb079c6fc091787380b6

Download Submit
memory/3628-150-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3628-156-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4732-133-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4732-134-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4732-141-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download