f13b1031927ae0c9e86dd630793378c674b066939e90daca7dfca0c4bd1aea10

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c249fa86f1b7f_JC.exe
Size

139KB
MD5

5c249fa86f1b7f6b0ba1c97db6408023
SHA1

a49edddc00db8d74c5fac1c10bfdfa6b32d09c4d
SHA256

f13b1031927ae0c9e86dd630793378c674b066939e90daca7dfca0c4bd1aea10
SHA512

5a89a53cc8bf1f691dd3f283aa8d427a192cea29ad3d8bca0602442a72cbd73d64b30c01ee01aa5b2ffb382739e9763a7e5267703a44065ff6d43d642098c860
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699G1mb:z6a+CdOOtEvwDpjczN

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	5c249fa86f1b7f_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3340	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1744-133-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0008000000023206-146.dat	upx
behavioral2/files/0x0008000000023206-148.dat	upx
behavioral2/files/0x0008000000023206-149.dat	upx
behavioral2/memory/1744-150-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3340-158-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3340	1744	5c249fa86f1b7f_JC.exe	85
PID 1744 wrote to memory of 3340	1744	5c249fa86f1b7f_JC.exe	85
PID 1744 wrote to memory of 3340	1744	5c249fa86f1b7f_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\5c249fa86f1b7f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5c249fa86f1b7f_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
516dc902ba82bb4899b0aa3a49480bf4

SHA1
2911693d9bc6175a6a6436baa535bf0cb3f3e611

SHA256
8ca1710c63ac83b84c7cd71981cf6d193767c073e99705c97b56454df5300b8e

SHA512
8c8166b660f101695e16c49785914ef76476bdda0a5535243faaeb5fa9650e8f3045f08e40148df61fe151e6ea1ba638cfded8ce0bcc0e8b73b6bad32e67bf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
516dc902ba82bb4899b0aa3a49480bf4

SHA1
2911693d9bc6175a6a6436baa535bf0cb3f3e611

SHA256
8ca1710c63ac83b84c7cd71981cf6d193767c073e99705c97b56454df5300b8e

SHA512
8c8166b660f101695e16c49785914ef76476bdda0a5535243faaeb5fa9650e8f3045f08e40148df61fe151e6ea1ba638cfded8ce0bcc0e8b73b6bad32e67bf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
516dc902ba82bb4899b0aa3a49480bf4

SHA1
2911693d9bc6175a6a6436baa535bf0cb3f3e611

SHA256
8ca1710c63ac83b84c7cd71981cf6d193767c073e99705c97b56454df5300b8e

SHA512
8c8166b660f101695e16c49785914ef76476bdda0a5535243faaeb5fa9650e8f3045f08e40148df61fe151e6ea1ba638cfded8ce0bcc0e8b73b6bad32e67bf65

Download Submit
memory/1744-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1744-134-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1744-135-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1744-136-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1744-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3340-158-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download