cd0d26e20d879311e56ba7f57683e25eca1983eba16c58abb2b591373ee723c5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bba48bf134953b_JC.exe
Size

78KB
MD5

bba48bf134953bb4279d96eae4e30a77
SHA1

e6dbe66a2e7972857a663b4d5298e98a44206813
SHA256

cd0d26e20d879311e56ba7f57683e25eca1983eba16c58abb2b591373ee723c5
SHA512

46a4b02c8e9a8c6553169e078093a6ae3f97a1c6073c381cfda664cb7d89e7d1eef23efe66e8f0d99619898c13d2010a180ca3050713ac0d03fe317630c88ed6
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSnU3:1nK6a+qdOOtEvwDpjc

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	bba48bf134953b_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3724	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4580-133-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x000700000002320e-146.dat	upx
behavioral2/files/0x000700000002320e-148.dat	upx
behavioral2/files/0x000700000002320e-149.dat	upx
behavioral2/memory/4580-150-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/3724-158-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3724	4580	bba48bf134953b_JC.exe	85
PID 4580 wrote to memory of 3724	4580	bba48bf134953b_JC.exe	85
PID 4580 wrote to memory of 3724	4580	bba48bf134953b_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
4de4e2e5b7da7306336429e860b2b404

SHA1
a5943b8d5cc664c1f466b140519186b43c57cc21

SHA256
5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

SHA512
ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

Download Submit
memory/3724-158-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4580-133-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4580-134-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4580-135-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4580-136-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4580-150-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download