fe7b1e4f1050ab936f846e518e833fedde328faf84032172d166a89a9c9c4b85

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2023 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88030af2458f8cexeexeexeex.exe
Size

90KB
MD5

88030af2458f8c026e9553e6257d22ad
SHA1

98af80af0ec535fba4a553e5dbbad20f3d03dc81
SHA256

fe7b1e4f1050ab936f846e518e833fedde328faf84032172d166a89a9c9c4b85
SHA512

cdfa5742445e4ebbca913775f82da8bb906e396b8eb7f5574c7f23c9501b3174914cd03fa2de1fa6fe6f86ba8e6f992fb6ef3e84f612a85d20aa39fb69a2948c
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpMx7a:AnBdOOtEvwDpj6za

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	88030af2458f8cexeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4388	asih.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4916-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x000a000000022fb8-145.dat	upx
behavioral2/files/0x000a000000022fb8-147.dat	upx
behavioral2/memory/4388-149-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x000a000000022fb8-148.dat	upx
behavioral2/memory/4916-150-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/4388-158-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4388	4916	88030af2458f8cexeexeexeex.exe	85
PID 4916 wrote to memory of 4388	4916	88030af2458f8cexeexeexeex.exe	85
PID 4916 wrote to memory of 4388	4916	88030af2458f8cexeexeexeex.exe	85

C:\Users\Admin\AppData\Local\Temp\88030af2458f8cexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\88030af2458f8cexeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
daa437ff7013e98bbe19663bced6880c

SHA1
e58ad8eb6d2bec903c57b7cc61c465d52b5ccf61

SHA256
f57dc5bdd373c0ec3445833da91074bb8a49d60be3cc5a87fbc365c0eb4722a1

SHA512
524ef29d2a71920ce3f4a256b4783aa4b43661c81cf63b77f1966428a807fa8458f087797980d21baa6d561f1647dd1b720cbaa9577181e2fcd8195aafcdb2a9

Download Submit
memory/4388-149-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4388-152-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4388-158-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4916-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4916-134-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/4916-135-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/4916-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download