Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 01:57

General

  • Target

    3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe

  • Size

    135.5MB

  • MD5

    a29499e8be6b7dea813f205e32eb50fb

  • SHA1

    399f0825c64f8b952028bbf9d979d72201d8558b

  • SHA256

    3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737

  • SHA512

    37ba7e993b84a0f599b53736f30e82b0c715d6785c68b5f6afd9a1de86f67e0ff9d169646614ad0b1cd2c6605abc9f307d1bdeabeb3f6b5d4998b1e55ceb7ad2

  • SSDEEP

    1572864:VmS69jSgB4/OS0ezBbURMPzOebc8vVIMm8V3K8rD0:wS69jSgBWzOeRz0

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe
    "C:\Users\Admin\AppData\Local\Temp\3c5a1cabe5af02c496c2ca81a873276b7b08013c2612b9823d0556c0845c7737.exe"
    1⤵
    • Checks computer location settings
    • Enumerates system info in registry
    PID:5116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pocket_updater_settings.json

    Filesize

    623B

    MD5

    8e16c1045f8ff1110fe90580178afde4

    SHA1

    efc9131b2f53c0df0f32611a71a8d5e20f2143ad

    SHA256

    d09820037f96a1cd67b27cb4d150bb246b20fd7cc79983ebd673e6528d9e62cf

    SHA512

    a39229fb41928daf644842c8b27c0f9565d28668fa3e2d8f48d9d2939268a9315d37bc183357611cb9a7034404952caa7f46eed8531fac58b72da56d3a33b61f

  • memory/5116-50-0x0000000006BF0000-0x0000000006BF9000-memory.dmp

    Filesize

    36KB

  • memory/5116-66-0x00000000072E0000-0x00000000072E5000-memory.dmp

    Filesize

    20KB

  • memory/5116-5-0x0000000000830000-0x000000000107F000-memory.dmp

    Filesize

    8.3MB

  • memory/5116-31-0x0000000006C00000-0x0000000006C12000-memory.dmp

    Filesize

    72KB

  • memory/5116-47-0x0000000006BF0000-0x0000000006BF9000-memory.dmp

    Filesize

    36KB

  • memory/5116-27-0x0000000006BC0000-0x0000000006BD5000-memory.dmp

    Filesize

    84KB

  • memory/5116-58-0x0000000006EF0000-0x0000000006EF6000-memory.dmp

    Filesize

    24KB

  • memory/5116-46-0x0000000006C30000-0x0000000006C54000-memory.dmp

    Filesize

    144KB

  • memory/5116-67-0x0000000007F30000-0x0000000007F43000-memory.dmp

    Filesize

    76KB

  • memory/5116-43-0x0000000006C30000-0x0000000006C54000-memory.dmp

    Filesize

    144KB

  • memory/5116-62-0x0000000007F90000-0x0000000008035000-memory.dmp

    Filesize

    660KB

  • memory/5116-59-0x0000000007F90000-0x0000000008035000-memory.dmp

    Filesize

    660KB

  • memory/5116-55-0x0000000006EF0000-0x0000000006EF6000-memory.dmp

    Filesize

    24KB

  • memory/5116-54-0x0000000007160000-0x0000000007249000-memory.dmp

    Filesize

    932KB

  • memory/5116-51-0x0000000007160000-0x0000000007249000-memory.dmp

    Filesize

    932KB

  • memory/5116-0-0x0000000007310000-0x0000000007C99000-memory.dmp

    Filesize

    9.5MB

  • memory/5116-28-0x0000000006C00000-0x0000000006C12000-memory.dmp

    Filesize

    72KB

  • memory/5116-4-0x0000000008890000-0x0000000009479000-memory.dmp

    Filesize

    11.9MB

  • memory/5116-63-0x00000000072E0000-0x00000000072E5000-memory.dmp

    Filesize

    20KB

  • memory/5116-42-0x0000000006F30000-0x0000000006F6A000-memory.dmp

    Filesize

    232KB

  • memory/5116-39-0x0000000006F30000-0x0000000006F6A000-memory.dmp

    Filesize

    232KB

  • memory/5116-38-0x0000000006C60000-0x0000000006C7D000-memory.dmp

    Filesize

    116KB

  • memory/5116-35-0x0000000006C60000-0x0000000006C7D000-memory.dmp

    Filesize

    116KB

  • memory/5116-24-0x0000000006BC0000-0x0000000006BD5000-memory.dmp

    Filesize

    84KB

  • memory/5116-23-0x0000000006B70000-0x0000000006B8F000-memory.dmp

    Filesize

    124KB

  • memory/5116-20-0x0000000006B70000-0x0000000006B8F000-memory.dmp

    Filesize

    124KB

  • memory/5116-19-0x0000000006B90000-0x0000000006B9C000-memory.dmp

    Filesize

    48KB

  • memory/5116-16-0x0000000006B90000-0x0000000006B9C000-memory.dmp

    Filesize

    48KB

  • memory/5116-15-0x0000000006E20000-0x0000000006ED4000-memory.dmp

    Filesize

    720KB

  • memory/5116-3-0x0000000007310000-0x0000000007C99000-memory.dmp

    Filesize

    9.5MB

  • memory/5116-12-0x0000000006E20000-0x0000000006ED4000-memory.dmp

    Filesize

    720KB

  • memory/5116-9-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/5116-8-0x0000000008890000-0x0000000009479000-memory.dmp

    Filesize

    11.9MB

  • memory/5116-190-0x0000000000830000-0x000000000107F000-memory.dmp

    Filesize

    8.3MB