8b056bf915447c3e61f54d2dd25e5b1062990c214bbc454b168575eab61f1342

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba21a3de7335f5exeexeexeex.exe
Size

120KB
MD5

ba21a3de7335f5905bd1a58c1e6c3e4a
SHA1

61e36da07cebae8560d01bc9ea1a84f78c3601cb
SHA256

8b056bf915447c3e61f54d2dd25e5b1062990c214bbc454b168575eab61f1342
SHA512

5f0c0e1645e431ba0586e0cba105da310d9c9a7e8f9b22d399a878b8a844100c65c8bbdcc8b910040fd4536c920d261f0dc7cc120b92690fd4929ed3af856e09
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eUq:AnBdOOtEvwDpj6zl

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	ba21a3de7335f5exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
2256	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2860-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x00080000000230a3-145.dat	upx
behavioral2/files/0x00080000000230a3-147.dat	upx
behavioral2/files/0x00080000000230a3-148.dat	upx
behavioral2/memory/2860-152-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/2256-157-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2256	2860	ba21a3de7335f5exeexeexeex.exe	84
PID 2860 wrote to memory of 2256	2860	ba21a3de7335f5exeexeexeex.exe	84
PID 2860 wrote to memory of 2256	2860	ba21a3de7335f5exeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\ba21a3de7335f5exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ba21a3de7335f5exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
120KB

MD5
e84f141e4561045678bd02e62f4665a2

SHA1
3c4c810a70fbd0ec2439644204bbeeb0c6512c2a

SHA256
7b3bddab80b35e896699362e5e5d89db0cc0f2b083b17123f7ccdd015e8fe217

SHA512
4756a458f1634c5fa2caff208d4dae76f29c1506f7ecff5e11ec68bbd50f299663f1b15dc76344843b1b9c82b8370aa6835469b32f20fe94593dbde63c04abe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
120KB

MD5
e84f141e4561045678bd02e62f4665a2

SHA1
3c4c810a70fbd0ec2439644204bbeeb0c6512c2a

SHA256
7b3bddab80b35e896699362e5e5d89db0cc0f2b083b17123f7ccdd015e8fe217

SHA512
4756a458f1634c5fa2caff208d4dae76f29c1506f7ecff5e11ec68bbd50f299663f1b15dc76344843b1b9c82b8370aa6835469b32f20fe94593dbde63c04abe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
120KB

MD5
e84f141e4561045678bd02e62f4665a2

SHA1
3c4c810a70fbd0ec2439644204bbeeb0c6512c2a

SHA256
7b3bddab80b35e896699362e5e5d89db0cc0f2b083b17123f7ccdd015e8fe217

SHA512
4756a458f1634c5fa2caff208d4dae76f29c1506f7ecff5e11ec68bbd50f299663f1b15dc76344843b1b9c82b8370aa6835469b32f20fe94593dbde63c04abe5

Download Submit
memory/2256-150-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2256-157-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2860-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2860-134-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2860-135-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/2860-152-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download