7219106a89d8993443c879120b2a3a6ce3002eb8fbb346d8b839539391082928

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdae74d6ef0965exeexeexeex.exe
Size

67KB
MD5

fdae74d6ef0965d6cd8d6a3d0e80c9e0
SHA1

253bb5f28f5738b6dfd866d7031c93374626e46b
SHA256

7219106a89d8993443c879120b2a3a6ce3002eb8fbb346d8b839539391082928
SHA512

8afbb8efffb43fde87e0b496a0298322942ae3522ec17f4b988001491d3bd5378d51ee6f6e658dcde3ec001b7db42ae106d814308c42485b664ca4bcc3155d0c
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVp4xSU:V6a+pOtEvwDpjvO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	fdae74d6ef0965exeexeexeex.exe

Executes dropped EXE 1 IoCs

pid	Process
4332	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4332	2772	fdae74d6ef0965exeexeexeex.exe	86
PID 2772 wrote to memory of 4332	2772	fdae74d6ef0965exeexeexeex.exe	86
PID 2772 wrote to memory of 4332	2772	fdae74d6ef0965exeexeexeex.exe	86

C:\Users\Admin\AppData\Local\Temp\fdae74d6ef0965exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\fdae74d6ef0965exeexeexeex.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
d76cd26dc90ecfbf386aaa18caf2087e

SHA1
8bf0f094edd1d6e72f456b133c9fb72a28419633

SHA256
9b8d13395e52f6a2649a8e470ab6ca389fb563a6067ad8484168075a6e7c3950

SHA512
874e644df40365d8ed51a444ee398cd1f40b3967b06539b5188c711b23015cb970f61f86360427b775150019d29e962d5ac5e1b204fd76d8489f4e78f79d82cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
d76cd26dc90ecfbf386aaa18caf2087e

SHA1
8bf0f094edd1d6e72f456b133c9fb72a28419633

SHA256
9b8d13395e52f6a2649a8e470ab6ca389fb563a6067ad8484168075a6e7c3950

SHA512
874e644df40365d8ed51a444ee398cd1f40b3967b06539b5188c711b23015cb970f61f86360427b775150019d29e962d5ac5e1b204fd76d8489f4e78f79d82cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
d76cd26dc90ecfbf386aaa18caf2087e

SHA1
8bf0f094edd1d6e72f456b133c9fb72a28419633

SHA256
9b8d13395e52f6a2649a8e470ab6ca389fb563a6067ad8484168075a6e7c3950

SHA512
874e644df40365d8ed51a444ee398cd1f40b3967b06539b5188c711b23015cb970f61f86360427b775150019d29e962d5ac5e1b204fd76d8489f4e78f79d82cb

Download Submit
memory/2772-133-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/2772-134-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4332-149-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download