Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
08/01/2024, 03:37
General
- Target 4a55d9c8cd6bfdf821400b79d891953b.exe
- Size 450KB
- Sample240108-d6tkksadgm
- SHA256 15ebf3b19a633b0780df6051fd63431d6cd577a4cdd33810f4b636ac1f6fd171
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a55d9c8cd6bfdf821400b79d891953b.exe"C:\Users\Admin\AppData\Local\Temp\4a55d9c8cd6bfdf821400b79d891953b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\setup.exe"C:\Users\Admin\AppData\Local\Temp\DM\setup.exe" /path="C:\Users\Admin\AppData\Local\Temp\4a55d9c8cd6bfdf821400b79d891953b.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
parent.txt
setup.exe
memory/3976-26-0x00007FFAB9DA0000-0x00007FFABA741000-memory.dmp
memory/3976-29-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-6-0x000000001B620000-0x000000001BAEE000-memory.dmp
memory/3976-5-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-7-0x000000001BB90000-0x000000001BC2C000-memory.dmp
memory/3976-8-0x0000000000B00000-0x0000000000B08000-memory.dmp
memory/3976-10-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-9-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-28-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-3-0x0000000000BE0000-0x0000000000C22000-memory.dmp
memory/3976-14-0x000000001F280000-0x000000001F2E2000-memory.dmp
memory/3976-15-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-24-0x00000000229A0000-0x0000000023146000-memory.dmp
memory/3976-25-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-4-0x00007FFAB9DA0000-0x00007FFABA741000-memory.dmp
memory/3976-2-0x00007FFAB9DA0000-0x00007FFABA741000-memory.dmp
memory/3976-11-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-27-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-30-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-31-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/3976-32-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-33-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-34-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-35-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-36-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-37-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-38-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-39-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-40-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-41-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-42-0x000000001F3F0000-0x0000000020A67000-memory.dmp
memory/3976-43-0x000000001F3F0000-0x0000000020A67000-memory.dmp