ccd08bc70e2ea4ec48df957c1ac63ac46d13a2628832706e68ad73128fefb7ad

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2023, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d19c121d1ae01_JC.exe
Size

74KB
MD5

8d19c121d1ae01d0166eb9168062acf6
SHA1

4f07bee9735c453f7267f34de4ba81c329bb5562
SHA256

ccd08bc70e2ea4ec48df957c1ac63ac46d13a2628832706e68ad73128fefb7ad
SHA512

1a6e3ccbf4c34b7c781b3227bb4f3a51716992b2ba8a14ba3609c11a1c757f9f266a2eb951960851a7ba0fb342c451c7ec101ec554c5a365fddc26687d8572b5
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDS2:1nK6a+qdOOtEvwDpjo

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	8d19c121d1ae01_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
920	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3068-133-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x000900000002320f-146.dat	upx
behavioral2/files/0x000900000002320f-148.dat	upx
behavioral2/files/0x000900000002320f-149.dat	upx
behavioral2/memory/3068-150-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/920-159-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 920	3068	8d19c121d1ae01_JC.exe	86
PID 3068 wrote to memory of 920	3068	8d19c121d1ae01_JC.exe	86
PID 3068 wrote to memory of 920	3068	8d19c121d1ae01_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\8d19c121d1ae01_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8d19c121d1ae01_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
ce6c7b7664e4d731dca7e2500a17dad0

SHA1
52eacc99e4b150dd657db52d9ffa1c4b2ff7f0ec

SHA256
f28d9a688dc2c525f27b1b2bc742b87eca0992a680914ca8cfe9e3237f4fa35d

SHA512
899ba52f470ea6f57c7de00db8a867f651f403ea122288b4e3d54bf2b60cea13937721fc55fb1fb25aae11e46d728b920702a436f4d6c4bba85e083c39d566d1

Download Submit
memory/920-152-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/920-153-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/920-159-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3068-133-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3068-134-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3068-135-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3068-136-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3068-150-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download