bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019

Analysis

max time kernel
190s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe
Size

1.6MB
MD5

ccf141b287b56de4f8b2dadc5c9e80d7
SHA1

2595d744e3d3dd4daea8969e636cef59e7c43e8c
SHA256

bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019
SHA512

62e1047e648bf36744fb063e14d18e9aad94d6c220e40ef5a4ffe7db79d43227cbe33d56bc674de913897b7159144cfd3b2bfa0372db8e04cca352a73b6c253f
SSDEEP

24576:8cbD/e1EBFQvdyHQCCH2itrMOK7073vNzwrhyFvad3A7hJH2HSfl4WfpJYC1WrQf:8cbi6QdyB+rn/9wlCvhoS7pNWrQE9i

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe

Loads dropped DLL 1 IoCs

pid	Process
1344	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1344	3620	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	84
PID 3620 wrote to memory of 1344	3620	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	84
PID 3620 wrote to memory of 1344	3620	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	84

C:\Users\Admin\AppData\Local\Temp\bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe
"C:\Users\Admin\AppData\Local\Temp\bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s UPT4NM.R
  2⤵
  - Loads dropped DLL
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UPT4NM.R

Filesize
1.4MB

MD5
068c04dbeb88b9eadd0a40fc3c0c1764

SHA1
65e2ca692631bba69c6c6fc652eefc29d47e44ed

SHA256
062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

SHA512
1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPT4Nm.R

Filesize
1.4MB

MD5
068c04dbeb88b9eadd0a40fc3c0c1764

SHA1
65e2ca692631bba69c6c6fc652eefc29d47e44ed

SHA256
062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

SHA512
1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

Download Submit
memory/1344-5-0x0000000010000000-0x0000000010167000-memory.dmp

Filesize
1.4MB

Download
memory/1344-4-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1344-8-0x0000000002B50000-0x0000000002C5D000-memory.dmp

Filesize
1.1MB

Download
memory/1344-9-0x0000000002C70000-0x0000000002D63000-memory.dmp

Filesize
972KB

Download
memory/1344-12-0x0000000002C70000-0x0000000002D63000-memory.dmp

Filesize
972KB

Download
memory/1344-13-0x0000000002C70000-0x0000000002D63000-memory.dmp

Filesize
972KB

Download
memory/1344-14-0x0000000010000000-0x0000000010167000-memory.dmp

Filesize
1.4MB

Download