ae492470b26d5287a7330e8a6cf9c54cb5d56dd5a57ce4d83949c3d7b33d2ba9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

773feac4e4815aexeexeexeex.exe
Size

64KB
MD5

773feac4e4815ad5993ca9e971f43e29
SHA1

3e9a51bd45760ca3d83eba11e50f1e8965dbc53a
SHA256

ae492470b26d5287a7330e8a6cf9c54cb5d56dd5a57ce4d83949c3d7b33d2ba9
SHA512

14e0db2366460efb2c838354404d7e89263bc82d1d87aec46d3ef13edb1d20690ed329df56e9fe0196f0ebcaabe0d9458d1d588cb38489a92bc8fb8326d2cfaf
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAh5gp:z6a+CdOOtEvwDpjQz

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	773feac4e4815aexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
1280	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4124-141-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0008000000023212-145.dat	upx
behavioral2/files/0x0008000000023212-147.dat	upx
behavioral2/files/0x0008000000023212-148.dat	upx
behavioral2/memory/1280-156-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1280	4124	773feac4e4815aexeexeexeex.exe	83
PID 4124 wrote to memory of 1280	4124	773feac4e4815aexeexeexeex.exe	83
PID 4124 wrote to memory of 1280	4124	773feac4e4815aexeexeexeex.exe	83

C:\Users\Admin\AppData\Local\Temp\773feac4e4815aexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\773feac4e4815aexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
a5cbc904391097adf57582a4871a3949

SHA1
a49b44ac7f5d976d541f96c81a41ee05ba782b6c

SHA256
2b65f714995999ee538d60f77886df027888740d36e6cadda1ffe25231a27c9e

SHA512
0c4fb6667af569e6306575e22fc15f1c02016d2c145f44ad68baf425f7e04bdde22e18cd28b735eeaff838ef28e1398c3a7e92e145b0ba4439fd7106648bbfdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
a5cbc904391097adf57582a4871a3949

SHA1
a49b44ac7f5d976d541f96c81a41ee05ba782b6c

SHA256
2b65f714995999ee538d60f77886df027888740d36e6cadda1ffe25231a27c9e

SHA512
0c4fb6667af569e6306575e22fc15f1c02016d2c145f44ad68baf425f7e04bdde22e18cd28b735eeaff838ef28e1398c3a7e92e145b0ba4439fd7106648bbfdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
a5cbc904391097adf57582a4871a3949

SHA1
a49b44ac7f5d976d541f96c81a41ee05ba782b6c

SHA256
2b65f714995999ee538d60f77886df027888740d36e6cadda1ffe25231a27c9e

SHA512
0c4fb6667af569e6306575e22fc15f1c02016d2c145f44ad68baf425f7e04bdde22e18cd28b735eeaff838ef28e1398c3a7e92e145b0ba4439fd7106648bbfdc

Download Submit
memory/1280-150-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1280-156-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4124-133-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/4124-134-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4124-141-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download