332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe
Size

1.8MB
MD5

ec61a28e0ed3fedebb254be1cf0cdbb5
SHA1

2cb5b641c1ae7d0a1bb448a8e99b66a6835e347e
SHA256

332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527
SHA512

4de42ae4b6e04bcf654dac6b133a64f0d9bd55ea16d38f459044e9cc07acb57e720c1b428fca71e4e5d884c5417c031c817a20add4664df6f6da194a675e1941
SSDEEP

24576:ChvJVJdM3W9xxoFFD0YzPTNUj1LuVrJkNwr4irpvOyds4glm5Yl/EL2BD09r5hE:S3dLxgR0YPNcwrjOh91E8QS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe

Executes dropped EXE 1 IoCs

pid	Process
484	SafeBox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 484	4164	332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe	88
PID 4164 wrote to memory of 484	4164	332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe	88
PID 4164 wrote to memory of 484	4164	332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe	88

C:\Users\Admin\AppData\Local\Temp\332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe
"C:\Users\Admin\AppData\Local\Temp\332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe"
  2⤵
  - Executes dropped EXE
  PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe

Filesize
10KB

MD5
36c8aad3c0d34e1e02dfff5e2cb31880

SHA1
c0977738854d245e4574e6d8e6522173f159eccb

SHA256
ea354f4d897601456d982ff2e8698509299c6bffb31e87bce4337b0a7e7d2ff2

SHA512
81dcfc799673582ec6a077ed984304baf776ae7144f4ad8bebbed622c6d2c2d890325f349ac1822e32ae469e5b49bf325574cf4f346efc3fd54dee820d9ff872

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe

Filesize
10KB

MD5
36c8aad3c0d34e1e02dfff5e2cb31880

SHA1
c0977738854d245e4574e6d8e6522173f159eccb

SHA256
ea354f4d897601456d982ff2e8698509299c6bffb31e87bce4337b0a7e7d2ff2

SHA512
81dcfc799673582ec6a077ed984304baf776ae7144f4ad8bebbed622c6d2c2d890325f349ac1822e32ae469e5b49bf325574cf4f346efc3fd54dee820d9ff872

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe

Filesize
10KB

MD5
36c8aad3c0d34e1e02dfff5e2cb31880

SHA1
c0977738854d245e4574e6d8e6522173f159eccb

SHA256
ea354f4d897601456d982ff2e8698509299c6bffb31e87bce4337b0a7e7d2ff2

SHA512
81dcfc799673582ec6a077ed984304baf776ae7144f4ad8bebbed622c6d2c2d890325f349ac1822e32ae469e5b49bf325574cf4f346efc3fd54dee820d9ff872

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe.config

Filesize
189B

MD5
da0eed2f114f1288c8de452d5b95596e

SHA1
1cf8a57c6df6c309f373a2114a88b980a49d03e5

SHA256
ae5e7fa8373b273fad07e0486cebfd88c18f9517ba609c2b8e6534f5d9e53dcb

SHA512
a2b2f1cd8a772aa3ef074864dd1ce8a37fdb2a1a811b476dfb360f1c71fc787560e9f188916e2c73b290eda74a56251ddd8ef85dd462515df12d2e073da9cf38

Download Submit
memory/484-25-0x0000000072BE0000-0x0000000073390000-memory.dmp

Filesize
7.7MB

Download
memory/484-26-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/484-27-0x0000000005820000-0x0000000005DC4000-memory.dmp

Filesize
5.6MB

Download
memory/484-28-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/484-29-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/484-30-0x00000000052B0000-0x00000000052BA000-memory.dmp

Filesize
40KB

Download
memory/484-31-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/484-32-0x0000000072BE0000-0x0000000073390000-memory.dmp

Filesize
7.7MB

Download
memory/484-33-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/484-34-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download