55e097d3c8bcae2ebd43f9bd054eccb274b7d0d3a8a4026170a5fdb9b0f793e6

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25095cd5326c5c3972a94c82e5bc368d.exe
Size

678KB
MD5

25095cd5326c5c3972a94c82e5bc368d
SHA1

af568d5edad1174a662d7e52fab148548152dc4c
SHA256

55e097d3c8bcae2ebd43f9bd054eccb274b7d0d3a8a4026170a5fdb9b0f793e6
SHA512

14e1f9612c45dd1390836cb2bc154a9569bb1875c2c6cd93adf22db7127e7e6bf747cee0c5c07311c038812230b2e025c75151925c65630bd9373e33be833d81
SSDEEP

12288:B27/bTehEqclr/tOCvrK7TggkHpRI26/LinyFmaXUxH9K8iszknSau+dGHlNz30:Bu/PWcx/f27Tob6/LinYmaXUxHRdFRH4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	25095cd5326c5c3972a94c82e5bc368d.exe

Executes dropped EXE 1 IoCs

pid	Process
4724	Bifrost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4724	Bifrost.exe
4724	Bifrost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 4724	776	25095cd5326c5c3972a94c82e5bc368d.exe	91
PID 776 wrote to memory of 4724	776	25095cd5326c5c3972a94c82e5bc368d.exe	91
PID 776 wrote to memory of 4724	776	25095cd5326c5c3972a94c82e5bc368d.exe	91

C:\Users\Admin\AppData\Local\Temp\25095cd5326c5c3972a94c82e5bc368d.exe
"C:\Users\Admin\AppData\Local\Temp\25095cd5326c5c3972a94c82e5bc368d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\Bifrost.exe
  "C:\Users\Admin\AppData\Local\Temp\Bifrost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bifrost.exe

Filesize
607KB

MD5
c390fa302fad89aa84e295a6a5473fd4

SHA1
9915d7cf90b88c50aa4e387ba4ce12cc98eeef9d

SHA256
c8dcc9b7ab64c622d1d19bfe0316ac28a65e3f804d5b0843d2f7a4acf70ece4c

SHA512
8f98d778491192fe77f5d970db419bb72ef4b6fcb6267747b2d4a3c9aea5f46f16c6e9d37c7ceaa10be3dd0af5bc30f2a3c1cd267909f596aa5be4d3c6b35d5d

Download Submit
memory/4724-12-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/4724-13-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/4724-14-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/4724-15-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download