ad9c7af58ddb58fd2f88f11a294e0127545b7dd410b7ea1b657aa38da6479486

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_2501b75a74a8c9exeexe_JC.exe
Size

117KB
MD5

2501b75a74a8c994351a5542181dd964
SHA1

b10eab5d710fab188fb8cc7f91f9f227e2b223a0
SHA256

ad9c7af58ddb58fd2f88f11a294e0127545b7dd410b7ea1b657aa38da6479486
SHA512

2150a8c49b4f2e36dbcbd97d0f63ce11699d1b6b56c84abf676940ad3e9eb825d94ed67955865136a658cf9ba5ce1bb5d4ee444243f02a8ff4f7598b02bb0b28
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eX:AnBdOOtEvwDpj6zd

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	NA_NA_2501b75a74a8c9exeexe_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x00070000000230af-146.dat	upx
behavioral2/files/0x00070000000230af-148.dat	upx
behavioral2/files/0x00070000000230af-149.dat	upx
behavioral2/memory/4696-151-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/2392-159-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2392	4696	NA_NA_2501b75a74a8c9exeexe_JC.exe	85
PID 4696 wrote to memory of 2392	4696	NA_NA_2501b75a74a8c9exeexe_JC.exe	85
PID 4696 wrote to memory of 2392	4696	NA_NA_2501b75a74a8c9exeexe_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\NA_NA_2501b75a74a8c9exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_2501b75a74a8c9exeexe_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
118KB

MD5
d5b9ab40ee295d3a19e3cf1526d32d21

SHA1
6aba83c438898ab70bbc067f9aca7791fe9e3c68

SHA256
368b4e171de67d70e8332928272bd1e77be167b76556cfb004d9160f13bd86fb

SHA512
556e5fafd15f827dce78345d612a7bc869c3896c8fbeb585538f1b5827473d4a20c22e4d84c0eb294123bc816673a6b47a4ab3f5566a5b9f6afc085608295814

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
118KB

MD5
d5b9ab40ee295d3a19e3cf1526d32d21

SHA1
6aba83c438898ab70bbc067f9aca7791fe9e3c68

SHA256
368b4e171de67d70e8332928272bd1e77be167b76556cfb004d9160f13bd86fb

SHA512
556e5fafd15f827dce78345d612a7bc869c3896c8fbeb585538f1b5827473d4a20c22e4d84c0eb294123bc816673a6b47a4ab3f5566a5b9f6afc085608295814

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
118KB

MD5
d5b9ab40ee295d3a19e3cf1526d32d21

SHA1
6aba83c438898ab70bbc067f9aca7791fe9e3c68

SHA256
368b4e171de67d70e8332928272bd1e77be167b76556cfb004d9160f13bd86fb

SHA512
556e5fafd15f827dce78345d612a7bc869c3896c8fbeb585538f1b5827473d4a20c22e4d84c0eb294123bc816673a6b47a4ab3f5566a5b9f6afc085608295814

Download Submit
memory/2392-152-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2392-153-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2392-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4696-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4696-134-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4696-135-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4696-136-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4696-151-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download