98eef653d9953297c34b0e68fd438b31602421ffc807c0ec176fb6180ba5b1e4

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c407f9c7ee5c99_JC.exe
Size

77KB
MD5

c407f9c7ee5c9926de39b56e38b6ca76
SHA1

940298592a72590870211c0aaec5b2a054cd0214
SHA256

98eef653d9953297c34b0e68fd438b31602421ffc807c0ec176fb6180ba5b1e4
SHA512

cddb0a65b63ee2585e838a686bf28bcdbdf9a34ff151aa298cf5e1a1b4303171193566e7531a018836094f7b2802a8fb3d6db053a91ef6e9d2f0ba9bdb737789
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOTdSWCP8:T6a+rdOOtEvwDpjNz

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	c407f9c7ee5c99_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1312	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2864-133-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00080000000231e8-146.dat	upx
behavioral2/files/0x00080000000231e8-148.dat	upx
behavioral2/files/0x00080000000231e8-149.dat	upx
behavioral2/memory/2864-150-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1312-159-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1312	2864	c407f9c7ee5c99_JC.exe	84
PID 2864 wrote to memory of 1312	2864	c407f9c7ee5c99_JC.exe	84
PID 2864 wrote to memory of 1312	2864	c407f9c7ee5c99_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\c407f9c7ee5c99_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c407f9c7ee5c99_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
86a4f879b2943bc566fdde41ed38d1f0

SHA1
d47510489e77388074eb86290ade6bf9c34f476b

SHA256
1d065ce05b1890ceb6a56ab272fd370f4665ce264ca22af67929097a4844fd0c

SHA512
50be00ece6ecaab5875df46a91953e4dfcb07ee559fd85e7b895b58ee4c7ff46b4e496a51fa42b1d07623f5e748f7da2276c1a58fe4640a81d9e4db2230b0ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
86a4f879b2943bc566fdde41ed38d1f0

SHA1
d47510489e77388074eb86290ade6bf9c34f476b

SHA256
1d065ce05b1890ceb6a56ab272fd370f4665ce264ca22af67929097a4844fd0c

SHA512
50be00ece6ecaab5875df46a91953e4dfcb07ee559fd85e7b895b58ee4c7ff46b4e496a51fa42b1d07623f5e748f7da2276c1a58fe4640a81d9e4db2230b0ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
86a4f879b2943bc566fdde41ed38d1f0

SHA1
d47510489e77388074eb86290ade6bf9c34f476b

SHA256
1d065ce05b1890ceb6a56ab272fd370f4665ce264ca22af67929097a4844fd0c

SHA512
50be00ece6ecaab5875df46a91953e4dfcb07ee559fd85e7b895b58ee4c7ff46b4e496a51fa42b1d07623f5e748f7da2276c1a58fe4640a81d9e4db2230b0ef7

Download Submit
memory/1312-153-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1312-152-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1312-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2864-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2864-134-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2864-135-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2864-136-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2864-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download