f24a2c639bd12c10f2e77635530121d25df5c3013e0530f542a20990e00d1696

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2023, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8370944043324c_JC.exe
Size

90KB
MD5

8370944043324c4320f5d162ed117363
SHA1

5182392ae0889b87804d33fe67f000d78806743e
SHA256

f24a2c639bd12c10f2e77635530121d25df5c3013e0530f542a20990e00d1696
SHA512

01f29e70b6b25879298f8caec8af958a0862878bdf1efbe435c81806ca4df16fdba7f2800f00e56b62c9f64b6babc93ce5cdd89e71dc945429d67d582dbbb881
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpMx7h:AnBdOOtEvwDpj6zh

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	8370944043324c_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1028	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4204-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x00090000000231f2-146.dat	upx
behavioral2/memory/4204-150-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x00090000000231f2-149.dat	upx
behavioral2/files/0x00090000000231f2-148.dat	upx
behavioral2/memory/1028-159-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1028	4204	8370944043324c_JC.exe	85
PID 4204 wrote to memory of 1028	4204	8370944043324c_JC.exe	85
PID 4204 wrote to memory of 1028	4204	8370944043324c_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\8370944043324c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8370944043324c_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
f33afca3f1cde50692e016b6988408fa

SHA1
68f1a1c79ee880da470b4b6bf7c3e8f4d597177f

SHA256
59d88b13e1c52db3ec94814a16b28224cfffce534fca73672a0f7fedc26d6acb

SHA512
2e31365ee90fd481dcf1299e047a6d43a18bc70b76311e8de28f0800b1d9ba151d9eb1d31711a1bea0cc18fd7095deb64bf71a2de9a260c1ea132334b6d3a443

Download Submit
memory/1028-152-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1028-153-0x0000000000770000-0x0000000000776000-memory.dmp

Filesize
24KB

Download
memory/1028-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4204-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4204-134-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4204-135-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4204-136-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4204-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download