3ca9f53de298922167a078f225b3a4deabc2ffe2f69f829f336feef33497899c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

559c36a6aaefe8_JC.exe
Size

100KB
MD5

559c36a6aaefe8be70ffd020082bfeb9
SHA1

c30bfac471a1cc039526fd6bfabba711734e6369
SHA256

3ca9f53de298922167a078f225b3a4deabc2ffe2f69f829f336feef33497899c
SHA512

d0dfab37a517c3ce8afebc33608fdca1303fa5208420978b7513e7e679e10987d05782df2d3cc5f449bec017eb247c71392dc54b6de912e0475dcd2543e2faa4
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GCu:1nK6a+qdOOtEvwDpj7

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	559c36a6aaefe8_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3848	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3876-133-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x0003000000015cff-146.dat	upx
behavioral2/files/0x0003000000015cff-148.dat	upx
behavioral2/files/0x0003000000015cff-149.dat	upx
behavioral2/memory/3876-150-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/3848-158-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3848	3876	559c36a6aaefe8_JC.exe	86
PID 3876 wrote to memory of 3848	3876	559c36a6aaefe8_JC.exe	86
PID 3876 wrote to memory of 3848	3876	559c36a6aaefe8_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\559c36a6aaefe8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\559c36a6aaefe8_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
100KB

MD5
ea6bc558bc4bdc09b2c12886e2bdf3c7

SHA1
482d4acf6b629a431317a5323838af7458e234fd

SHA256
7fe3584854527473f4dfa11f12f2a62bff0d7d2468afc24a0e0952a87df3db09

SHA512
3a47d632e99f10136a4e96901f718fd66f81b1cb34fb7b0420768b9a2badb25f2534df4656226fa7e943a51d86366209fcca9603e3e3b5e1ecae8a2844d98b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
100KB

MD5
ea6bc558bc4bdc09b2c12886e2bdf3c7

SHA1
482d4acf6b629a431317a5323838af7458e234fd

SHA256
7fe3584854527473f4dfa11f12f2a62bff0d7d2468afc24a0e0952a87df3db09

SHA512
3a47d632e99f10136a4e96901f718fd66f81b1cb34fb7b0420768b9a2badb25f2534df4656226fa7e943a51d86366209fcca9603e3e3b5e1ecae8a2844d98b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
100KB

MD5
ea6bc558bc4bdc09b2c12886e2bdf3c7

SHA1
482d4acf6b629a431317a5323838af7458e234fd

SHA256
7fe3584854527473f4dfa11f12f2a62bff0d7d2468afc24a0e0952a87df3db09

SHA512
3a47d632e99f10136a4e96901f718fd66f81b1cb34fb7b0420768b9a2badb25f2534df4656226fa7e943a51d86366209fcca9603e3e3b5e1ecae8a2844d98b2e

Download Submit
memory/3848-152-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/3848-158-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3876-133-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3876-134-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3876-135-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3876-136-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/3876-150-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download