c426c3a784c8128aeef799778bc327f6b59dfe2ac9b0fb47aadedfde0f8d9a04

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfcab26e2241b4exeexeexeex.exe
Size

36KB
MD5

bfcab26e2241b4685b9241354ed370b2
SHA1

27b49b8f20ae8a4388587208c98430b4a4803b69
SHA256

c426c3a784c8128aeef799778bc327f6b59dfe2ac9b0fb47aadedfde0f8d9a04
SHA512

eb831dca6a75a41ba7bfc3b136e5c4ee7c030827547057f4736ef1511ae11777cfd434a522fed6df3f8a75b058b3592d0ab6ec9944233278eb40b519e0cea89e
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+2ipd/:bgX4zYcgTEu6QOaryfjqDlCp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	bfcab26e2241b4exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4760	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4760	3280	bfcab26e2241b4exeexeexeex.exe	84
PID 3280 wrote to memory of 4760	3280	bfcab26e2241b4exeexeexeex.exe	84
PID 3280 wrote to memory of 4760	3280	bfcab26e2241b4exeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\bfcab26e2241b4exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\bfcab26e2241b4exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
c7f2df6e25dac890891343609bd72a72

SHA1
3b9d3071c4758fbd1f7ec59115e56ff15866e5f8

SHA256
a76de712ae53ee3195de727da63e8f6cb49e0e2991deef7189db64a5e70df8aa

SHA512
6fa097fb6b27a4a830b6b8485abd45b82a0132b95db34332f34f1ab5a8649cf763be0795579a64f347237e64214e43c25b3a93f8d9a79ccfd17393bdd32a4710

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
c7f2df6e25dac890891343609bd72a72

SHA1
3b9d3071c4758fbd1f7ec59115e56ff15866e5f8

SHA256
a76de712ae53ee3195de727da63e8f6cb49e0e2991deef7189db64a5e70df8aa

SHA512
6fa097fb6b27a4a830b6b8485abd45b82a0132b95db34332f34f1ab5a8649cf763be0795579a64f347237e64214e43c25b3a93f8d9a79ccfd17393bdd32a4710

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
c7f2df6e25dac890891343609bd72a72

SHA1
3b9d3071c4758fbd1f7ec59115e56ff15866e5f8

SHA256
a76de712ae53ee3195de727da63e8f6cb49e0e2991deef7189db64a5e70df8aa

SHA512
6fa097fb6b27a4a830b6b8485abd45b82a0132b95db34332f34f1ab5a8649cf763be0795579a64f347237e64214e43c25b3a93f8d9a79ccfd17393bdd32a4710

Download Submit
memory/3280-133-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/3280-134-0x0000000003120000-0x0000000003126000-memory.dmp

Filesize
24KB

Download
memory/4760-149-0x0000000002FE0000-0x0000000002FE6000-memory.dmp

Filesize
24KB

Download