541e7eb3677f54ed7b82903cd608c42aaf4ac28495d65ece13e23c6ca5169bc1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4479c37cb051a_JC.exe
Size

66KB
MD5

b4479c37cb051ae922d1d6278a50fb02
SHA1

e9d8814be2dc1b49f396c5cbbf561584339d2722
SHA256

541e7eb3677f54ed7b82903cd608c42aaf4ac28495d65ece13e23c6ca5169bc1
SHA512

cbee5a955f692c4a3a8d02480bedce5ed09f66d5130accbcc060dae5143772e9ffa34381592478a6ec94498e3ce5686d44b4bbcd0a07b04f179dc2b3b004dec4
SSDEEP

1536:79mqyNhQMOtEvwDpjBPY7xv3gnQe+OHF7c:RlqbOtEvwDpjBgf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation	b4479c37cb051a_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2360	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2360	4820	b4479c37cb051a_JC.exe	86
PID 4820 wrote to memory of 2360	4820	b4479c37cb051a_JC.exe	86
PID 4820 wrote to memory of 2360	4820	b4479c37cb051a_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\b4479c37cb051a_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b4479c37cb051a_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
66KB

MD5
19b1e959c1212fad7bbef9ec9995d476

SHA1
b41ac96c30ffff888288f392ac86c49c37d87ee4

SHA256
816584000902d59687deebb34530a822ded1c6427128a2dfc57d0e56e00cb553

SHA512
1371da4eb21fa740c83b7af7f96543f90706915474f75e592e2de21d6f3765f9e6d0dcc1405dcb958b4bd5fdaf871db482a886e217ce04bf19e4f92c4c4a87bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
66KB

MD5
19b1e959c1212fad7bbef9ec9995d476

SHA1
b41ac96c30ffff888288f392ac86c49c37d87ee4

SHA256
816584000902d59687deebb34530a822ded1c6427128a2dfc57d0e56e00cb553

SHA512
1371da4eb21fa740c83b7af7f96543f90706915474f75e592e2de21d6f3765f9e6d0dcc1405dcb958b4bd5fdaf871db482a886e217ce04bf19e4f92c4c4a87bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
66KB

MD5
19b1e959c1212fad7bbef9ec9995d476

SHA1
b41ac96c30ffff888288f392ac86c49c37d87ee4

SHA256
816584000902d59687deebb34530a822ded1c6427128a2dfc57d0e56e00cb553

SHA512
1371da4eb21fa740c83b7af7f96543f90706915474f75e592e2de21d6f3765f9e6d0dcc1405dcb958b4bd5fdaf871db482a886e217ce04bf19e4f92c4c4a87bb

Download Submit
memory/2360-152-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2360-153-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/2360-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4820-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4820-134-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4820-135-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4820-136-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4820-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download