Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2023 01:57
Behavioral task
behavioral1
Sample
3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe
Resource
win10v2004-20231130-en
General
-
Target
3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe
-
Size
135.5MB
-
MD5
a29499e8be6b7dea813f205e32eb50fb
-
SHA1
399f0825c64f8b952028bbf9d979d72201d8558b
-
SHA256
3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737
-
SHA512
37ba7e993b84a0f599b53736f30e82b0c715d6785c68b5f6afd9a1de86f67e0ff9d169646614ad0b1cd2c6605abc9f307d1bdeabeb3f6b5d4998b1e55ceb7ad2
-
SSDEEP
1572864:VmS69jSgB4/OS0ezBbURMPzOebc8vVIMm8V3K8rD0:wS69jSgBWzOeRz0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\Control Panel\International\Geo\Nation 3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
623B
MD58e16c1045f8ff1110fe90580178afde4
SHA1efc9131b2f53c0df0f32611a71a8d5e20f2143ad
SHA256d09820037f96a1cd67b27cb4d150bb246b20fd7cc79983ebd673e6528d9e62cf
SHA512a39229fb41928daf644842c8b27c0f9565d28668fa3e2d8f48d9d2939268a9315d37bc183357611cb9a7034404952caa7f46eed8531fac58b72da56d3a33b61f