3a555a7b63808b04ad9819f020ee104fdd8628b60dcffe8bb276901d965d52b2

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b64a50d5bd8406202d8d57dfee172db.exe
Size

124KB
MD5

4b64a50d5bd8406202d8d57dfee172db
SHA1

6e0d14010cc5883840e17546e5b03f1b98ca58fe
SHA256

3a555a7b63808b04ad9819f020ee104fdd8628b60dcffe8bb276901d965d52b2
SHA512

9a3983ac24bb2fbdfcfd124bb2283b426c42cd930f8e9040777b88c2809a8ac04f17d7f7d0974bccf60c65573a17f233d026bc62efe9aca8d9538d3ed99f5500
SSDEEP

1536:kjqGUXJ2q4D4o+Ny6NK4RKB7AWe1uvYV5eRiotRQNJUxAd6HwAYb3Z:kjqGUXJxhog47/e16YMCJ98wAYb

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	4b64a50d5bd8406202d8d57dfee172db.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4780-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4780	4b64a50d5bd8406202d8d57dfee172db.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4204	4780	4b64a50d5bd8406202d8d57dfee172db.exe	90
PID 4780 wrote to memory of 4204	4780	4b64a50d5bd8406202d8d57dfee172db.exe	90
PID 4780 wrote to memory of 4204	4780	4b64a50d5bd8406202d8d57dfee172db.exe	90

C:\Users\Admin\AppData\Local\Temp\4b64a50d5bd8406202d8d57dfee172db.exe
"C:\Users\Admin\AppData\Local\Temp\4b64a50d5bd8406202d8d57dfee172db.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dgb..bat" > nul 2> nul
  2⤵
  PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dgb..bat

Filesize
210B

MD5
3b033430ff1a3ec1f7588071201e933b

SHA1
587ec3840b078800224d13bd42c968871011e91f

SHA256
60ce2c4b99cc8e031167e0f94a835c89e1325fefcc398e301a9501ce3b0a8967

SHA512
4c269bdad7db8b30d84e162a5124d2410c65fda3a67468cc68b2842f64ccf55469f9585bbc9d8a1430e659d1818f7ae9bf1bae3c98731c636dbad667d780a279

Download Submit
memory/4780-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4780-1-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4780-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4780-3-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/4780-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download