51d921897f5aa6e6881538b65faa242de61bad6849faccd1ff52f2b5eb3f2507

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2023 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bf939aef9de3_JC.exe
Size

31KB
MD5

a3bf939aef9de3acbd851d03b464bff5
SHA1

32c0dd5cc60a7e52a8d9d315149fa14f433eb904
SHA256

51d921897f5aa6e6881538b65faa242de61bad6849faccd1ff52f2b5eb3f2507
SHA512

09a4402f91b09f63bd06adf5aba1efa523b88efa39e59ff10cb0fdaba13c1eafd174b15dac8fed2d9bcffbf1f8a40386e81663f582a8a57073ebda7294971440
SSDEEP

384:bAvMaNGh4z7CG3POOvbRSLoF/F0QU5XYFnufc/zzoiEcIuqFwfa:bAvJCYOOvbRPDEgXNZS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	a3bf939aef9de3_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4676	demka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4676	4244	a3bf939aef9de3_JC.exe	86
PID 4244 wrote to memory of 4676	4244	a3bf939aef9de3_JC.exe	86
PID 4244 wrote to memory of 4676	4244	a3bf939aef9de3_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\a3bf939aef9de3_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a3bf939aef9de3_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\demka.exe
  "C:\Users\Admin\AppData\Local\Temp\demka.exe"
  2⤵
  - Executes dropped EXE
  PID:4676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\demka.exe

Filesize
31KB

MD5
28aefa962b6be25221c0c845836aeb90

SHA1
f9c4fda31b323dc9e24cb22558ab30eb719cd6f3

SHA256
306abf9965ff559e07eb1b82650bf19c2f21d5c59e9512e96a35ac934f19c294

SHA512
6e61ae6320923d0c58de4abb4ffd867caf6a2185cc2d071cd9a604f66e79da29eb9f31ebea39191d0d97a284a366429a4691bf31bd6ff1d9d0808973359dcd41

Download Submit
memory/4244-133-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/4244-134-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/4244-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4676-153-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download