649d3f94b88b8c6eeca5d4c4af6cfd85917273ce582504f561f43fbe42246ca5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58529fb35b0bc5c0be345e195d4c5eb1.exe
Size

94KB
MD5

58529fb35b0bc5c0be345e195d4c5eb1
SHA1

5b1cfece48910bfcbf4d0f13abb11f51ce2c9fa6
SHA256

649d3f94b88b8c6eeca5d4c4af6cfd85917273ce582504f561f43fbe42246ca5
SHA512

2db0075cf9adab78a5db8612569130be1e5c5aeb26423800e80a4528f6aeee23f0bf792bd9d54e0158995618cbbe90bbc34c6087a50f5d705f1e137d5f46b757
SSDEEP

1536:rfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:rfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	58529fb35b0bc5c0be345e195d4c5eb1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3636	5108	58529fb35b0bc5c0be345e195d4c5eb1.exe	90
PID 5108 wrote to memory of 3636	5108	58529fb35b0bc5c0be345e195d4c5eb1.exe	90
PID 5108 wrote to memory of 3636	5108	58529fb35b0bc5c0be345e195d4c5eb1.exe	90

C:\Users\Admin\AppData\Local\Temp\58529fb35b0bc5c0be345e195d4c5eb1.exe
"C:\Users\Admin\AppData\Local\Temp\58529fb35b0bc5c0be345e195d4c5eb1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dpv..bat" > nul 2> nul
  2⤵
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dpv..bat

Filesize
210B

MD5
28978cfed0e1b950ea57676d592cf4b2

SHA1
07456ee086b69e7105b337dea294362cb9dc52e3

SHA256
ec0142b5e21deb8d43975d728a6b432f186da15e7bec09927e3f72fdfa3988b9

SHA512
e3331a60e6eecefc81bc04be1f1fc648bc6f3330be2062d43e5d0176736e0e556b0af9883363856f970d58c30f8cfd1d86c76fafcd6f3687f070a17439406940

Download Submit
memory/5108-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5108-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/5108-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5108-3-0x0000000000660000-0x000000000067B000-memory.dmp

Filesize
108KB

Download
memory/5108-4-0x0000000000660000-0x000000000067B000-memory.dmp

Filesize
108KB

Download
memory/5108-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download