41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd

Analysis

max time kernel
175s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe
Size

1.6MB
MD5

f3aef5d479e4771ea74b05f4776986fe
SHA1

4a7418ddc74ad41c4064aa6a66e87165bd56c397
SHA256

41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd
SHA512

b529dba6017bdb1e9fdf5bad9af90d591a21658b2d9ad47b1597ab5c942a54b8630194c6dc738f1fd2a4f2b3104cc42d23e6bef5180cd1bb44d812380ad0b3ae
SSDEEP

24576:8cbD/e1EBinxzZX9RqxgQbljOvBQ2f/P8SNTptJGROxe8UtALyqrD1e0arLt:8cbi6gxtX9UxgMoxn8SLCcIAL/H1e9rh

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe

Loads dropped DLL 1 IoCs

pid	Process
4472	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4472	4988	41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe	90
PID 4988 wrote to memory of 4472	4988	41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe	90
PID 4988 wrote to memory of 4472	4988	41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe	90

C:\Users\Admin\AppData\Local\Temp\41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe
"C:\Users\Admin\AppData\Local\Temp\41bc459d9debe1a536961881beaa11117df335445d11d469436fcaa9aa9735cd.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /u ~~z6bpIQ.g -S
  2⤵
  - Loads dropped DLL
  PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~~z6bpIQ.g

Filesize
1.4MB

MD5
5b8edad5ad7e530abcda7a1e5e434080

SHA1
08c13133dd0dd8f9560e2f247332cadfb3fdb3f9

SHA256
f3fefb360d062830a44b01995a25ecabf600177667dcc250c516048923d938b0

SHA512
52ee58b20a44c1b2e67c5a33525fd47dab34dd628db83842b8875b269d61ad9632143db11b7b82f718a4e9d04b4329cac4325bf5ef4bd20fb58559a7551b4573

Download Submit
C:\Users\Admin\AppData\Local\Temp\~~z6bpiQ.g

Filesize
1.4MB

MD5
5b8edad5ad7e530abcda7a1e5e434080

SHA1
08c13133dd0dd8f9560e2f247332cadfb3fdb3f9

SHA256
f3fefb360d062830a44b01995a25ecabf600177667dcc250c516048923d938b0

SHA512
52ee58b20a44c1b2e67c5a33525fd47dab34dd628db83842b8875b269d61ad9632143db11b7b82f718a4e9d04b4329cac4325bf5ef4bd20fb58559a7551b4573

Download Submit
memory/4472-4-0x0000000000C20000-0x0000000000C26000-memory.dmp

Filesize
24KB

Download
memory/4472-5-0x0000000010000000-0x0000000010172000-memory.dmp

Filesize
1.4MB

Download
memory/4472-7-0x0000000002A00000-0x0000000002B1D000-memory.dmp

Filesize
1.1MB

Download
memory/4472-8-0x0000000002B20000-0x0000000002C21000-memory.dmp

Filesize
1.0MB

Download
memory/4472-11-0x0000000002B20000-0x0000000002C21000-memory.dmp

Filesize
1.0MB

Download
memory/4472-12-0x0000000002B20000-0x0000000002C21000-memory.dmp

Filesize
1.0MB

Download