e6868b855b3c274aa05b9c7890e5bee1f28204036d276bf1edf6478c2249eeab

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d559dc50e5d6a7exeexeexeex.exe
Size 42KB
Sample230710-v7x3tscc82
SHA256 e6868b855b3c274aa05b9c7890e5bee1f28204036d276bf1edf6478c2249eeab
MD5 d559dc50e5d6a7eb3de4f067d28f1a80
SHA1 acd7be6be21493398ace2c558718878f7e5c757b
SHA512 40f453ed06a322e4f5a723a364d2ff80d953e4f19242644915637efa6eda8f97b4be9449df8d3870c60b46e448ad048d2db90273a175ea78b02c6fa4544bd26d
SSDEEP 768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEq1xGN:X6QFElP6n+gJQMOtEvwDpjB0mGN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	d559dc50e5d6a7exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
3680	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3680	4188	d559dc50e5d6a7exeexeexeex.exe	83
PID 4188 wrote to memory of 3680	4188	d559dc50e5d6a7exeexeexeex.exe	83
PID 4188 wrote to memory of 3680	4188	d559dc50e5d6a7exeexeexeex.exe	83

C:\Users\Admin\AppData\Local\Temp\d559dc50e5d6a7exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\d559dc50e5d6a7exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asih.exe

Path C:\Users\Admin\AppData\Local\Temp\asih.exe
Size 42KB
SHA256 64f3cf150803ce871afb0fb18674ff493fb4e196daa56b343c7e2d8a338d23f8
MD5 287b999b4f29d5c9ddf4c6ffaa314b80
SHA1 daffff3bad328700974f7909ae2c215ad5eeb539
SHA512 a8124dc903fdc525c4190343a3746ac9f0fd640f76720f2ca154fa4b1a436a2137f4b99b5def36de8fd59a22a33203b0bf7e3084ff3bc4aab09c53d167654c51
SSDEEP 768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEq1xGB:X6QFElP6n+gJQMOtEvwDpjB0mGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

asih.exe

Path C:\Users\Admin\AppData\Local\Temp\asih.exe
Size 42KB
SHA256 64f3cf150803ce871afb0fb18674ff493fb4e196daa56b343c7e2d8a338d23f8
MD5 287b999b4f29d5c9ddf4c6ffaa314b80
SHA1 daffff3bad328700974f7909ae2c215ad5eeb539
SHA512 a8124dc903fdc525c4190343a3746ac9f0fd640f76720f2ca154fa4b1a436a2137f4b99b5def36de8fd59a22a33203b0bf7e3084ff3bc4aab09c53d167654c51
SSDEEP 768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEq1xGB:X6QFElP6n+gJQMOtEvwDpjB0mGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

asih.exe

Path C:\Users\Admin\AppData\Local\Temp\asih.exe
Size 42KB
SHA256 64f3cf150803ce871afb0fb18674ff493fb4e196daa56b343c7e2d8a338d23f8
MD5 287b999b4f29d5c9ddf4c6ffaa314b80
SHA1 daffff3bad328700974f7909ae2c215ad5eeb539
SHA512 a8124dc903fdc525c4190343a3746ac9f0fd640f76720f2ca154fa4b1a436a2137f4b99b5def36de8fd59a22a33203b0bf7e3084ff3bc4aab09c53d167654c51
SSDEEP 768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEq1xGB:X6QFElP6n+gJQMOtEvwDpjB0mGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3680-149-0x00000000004E0000-0x00000000004E6000-memory.dmp

Download

memory/4188-133-0x00000000006A0000-0x00000000006A6000-memory.dmp

Download

memory/4188-134-0x00000000006C0000-0x00000000006C6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads