fe072216a5fff9d4302b227748c10ad8511c7a7cd0f7507f2152dbb4049e7374

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e58434247892c57f2cc6b8552ed9dc90_exe32.exe
Size

40KB
MD5

e58434247892c57f2cc6b8552ed9dc90
SHA1

de9b125dee5fbd1a23bd4b51e7e81931cf4b793c
SHA256

fe072216a5fff9d4302b227748c10ad8511c7a7cd0f7507f2152dbb4049e7374
SHA512

835ef1d1ccb113fc783e8adfdb4f0b2f531f13a828a50ef23f00f47ccc0f06da742a074f0802c574290e677c5889e7916bcb1545968b6bdcd1a61ab519381dd0
SSDEEP

384:ODIg+GkEkTfjJGRKthVGQMkqFfJokrvGB5vuU4sdQprwqEvmnRRTxVQzu:OIHfj3hVSRJt+D2hZz0u

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	e58434247892c57f2cc6b8552ed9dc90_exe32.exe

Executes dropped EXE 1 IoCs

pid	Process
3208	wefi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3208	368	e58434247892c57f2cc6b8552ed9dc90_exe32.exe	82
PID 368 wrote to memory of 3208	368	e58434247892c57f2cc6b8552ed9dc90_exe32.exe	82
PID 368 wrote to memory of 3208	368	e58434247892c57f2cc6b8552ed9dc90_exe32.exe	82

C:\Users\Admin\AppData\Local\Temp\e58434247892c57f2cc6b8552ed9dc90_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\e58434247892c57f2cc6b8552ed9dc90_exe32.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\wefi.exe
  "C:\Users\Admin\AppData\Local\Temp\wefi.exe"
  2⤵
  - Executes dropped EXE
  PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wefi.exe

Filesize
40KB

MD5
1cbbf9bd65314ba742ff37988c1e6561

SHA1
7f9a16249484a495f7c858196cf6ebe95f02ae03

SHA256
4fcd320d57d58a6e9c5e2c7523c95fa21800008e5f553a61cbf07d504a963ac0

SHA512
577ce7fc30568b9b95ea2e7ebc7d3f36e60ed2ef381173a65f316172a5e8e8e9e2d9a0036961f706d8c9a4dcaa6b201857d3b13b61310e661a3ce12e53d5c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wefi.exe

Filesize
40KB

MD5
1cbbf9bd65314ba742ff37988c1e6561

SHA1
7f9a16249484a495f7c858196cf6ebe95f02ae03

SHA256
4fcd320d57d58a6e9c5e2c7523c95fa21800008e5f553a61cbf07d504a963ac0

SHA512
577ce7fc30568b9b95ea2e7ebc7d3f36e60ed2ef381173a65f316172a5e8e8e9e2d9a0036961f706d8c9a4dcaa6b201857d3b13b61310e661a3ce12e53d5c5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wefi.exe

Filesize
40KB

MD5
1cbbf9bd65314ba742ff37988c1e6561

SHA1
7f9a16249484a495f7c858196cf6ebe95f02ae03

SHA256
4fcd320d57d58a6e9c5e2c7523c95fa21800008e5f553a61cbf07d504a963ac0

SHA512
577ce7fc30568b9b95ea2e7ebc7d3f36e60ed2ef381173a65f316172a5e8e8e9e2d9a0036961f706d8c9a4dcaa6b201857d3b13b61310e661a3ce12e53d5c5c7

Download Submit
memory/368-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3208-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download