445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe
Size

1.6MB
MD5

26f4a901da10491c463a1544aa441f1a
SHA1

d7f8494aeef57bb7809c01fa00dbd4c6b772f02c
SHA256

445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43
SHA512

101fb400142bbe8075568c80e2f824fa70b4ddef0bac40ded155fa6d5b305d33cafcf60c8367dbf47210a57aec0166b6a8f1e58bb33795f46acca9ceb8d74e94
SSDEEP

24576:CGn8xjmViXYMnYdKwdkTOWKVwyHoIppbCiheLp/T7EgrdBcq0S3/jY3NOS:CvxfXTIKHOWKWFIphCdd/RxaS3/jYd3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe

Loads dropped DLL 1 IoCs

pid	Process
1584	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1584	4248	445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe	91
PID 4248 wrote to memory of 1584	4248	445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe	91
PID 4248 wrote to memory of 1584	4248	445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe	91

C:\Users\Admin\AppData\Local\Temp\445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe
"C:\Users\Admin\AppData\Local\Temp\445672b9e684943744d0de20643fb5700b524bfedd9f660f6b753434c4a44a43.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" LHVVVAmJ.D -u -s
  2⤵
  - Loads dropped DLL
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LHVVVAmJ.D

Filesize
1.4MB

MD5
cdb1cf4ad93287c6d312e1595c33624f

SHA1
28d908c42446679e9c27eb90f3ea8caba66f2d9e

SHA256
0dd5d72e971267273f655755da75f7dcd6a6e70a51d29ff53ff2b8d8b470cf34

SHA512
30227edfa01619248e562fabd4b675b21b1b16cd8a8365bafbd45b4956c845feeba602362d8d6bc18c2d0d5dde0e34b7675f6681ac4614dbe0253c301cb27c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\LHVVVAmj.D

Filesize
1.4MB

MD5
cdb1cf4ad93287c6d312e1595c33624f

SHA1
28d908c42446679e9c27eb90f3ea8caba66f2d9e

SHA256
0dd5d72e971267273f655755da75f7dcd6a6e70a51d29ff53ff2b8d8b470cf34

SHA512
30227edfa01619248e562fabd4b675b21b1b16cd8a8365bafbd45b4956c845feeba602362d8d6bc18c2d0d5dde0e34b7675f6681ac4614dbe0253c301cb27c97

Download Submit
memory/1584-4-0x0000000002850000-0x0000000002856000-memory.dmp

Filesize
24KB

Download
memory/1584-5-0x0000000010000000-0x0000000010171000-memory.dmp

Filesize
1.4MB

Download
memory/1584-9-0x0000000002C00000-0x0000000002D03000-memory.dmp

Filesize
1.0MB

Download
memory/1584-10-0x0000000002D20000-0x0000000002E0B000-memory.dmp

Filesize
940KB

Download
memory/1584-11-0x0000000010000000-0x0000000010171000-memory.dmp

Filesize
1.4MB

Download
memory/1584-12-0x0000000002D20000-0x0000000002E0B000-memory.dmp

Filesize
940KB

Download
memory/1584-14-0x0000000002D20000-0x0000000002E0B000-memory.dmp

Filesize
940KB

Download
memory/1584-15-0x0000000002D20000-0x0000000002E0B000-memory.dmp

Filesize
940KB

Download