Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 01:35
General
- Target 332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe
- Size 1.8MB
- Sample231014-bzndwaaa2t
- SHA256 332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe"C:\Users\Admin\AppData\Local\Temp\332807c10349cfc068a70cc2c4ef2ef72fc16b157dd278cac386b1fd552c7527.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\SafeBox.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SafeBox.exe
SafeBox.exe
SafeBox.exe
SafeBox.exe.config
memory/484-25-0x0000000072BE0000-0x0000000073390000-memory.dmp
memory/484-26-0x00000000009E0000-0x00000000009E8000-memory.dmp
memory/484-27-0x0000000005820000-0x0000000005DC4000-memory.dmp
memory/484-28-0x0000000005310000-0x00000000053A2000-memory.dmp
memory/484-29-0x0000000005460000-0x0000000005470000-memory.dmp
memory/484-30-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/484-31-0x0000000005460000-0x0000000005470000-memory.dmp
memory/484-32-0x0000000072BE0000-0x0000000073390000-memory.dmp
memory/484-33-0x0000000005460000-0x0000000005470000-memory.dmp
memory/484-34-0x0000000005460000-0x0000000005470000-memory.dmp