4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe
Size

196KB
MD5

e8c26eb033f6a36454f4fff82bee746d
SHA1

fbbd2652edb6e416f7d403f47ef02ee828bc4a43
SHA256

4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2
SHA512

c9abf35c2c9d09ab0ac9d3dff76ad1981d35a4bef00053511c058d4d890e7162ed4e5d692cac913314f1c250809c98f08b38044d2756b6f953cdd55dd4377f4a
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOq:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXT

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	mewhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\mewhost.exe	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe
File opened for modification	C:\Windows\Debug\mewhost.exe	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3076	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1620	3076	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe	85
PID 3076 wrote to memory of 1620	3076	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe	85
PID 3076 wrote to memory of 1620	3076	4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe	85

C:\Users\Admin\AppData\Local\Temp\4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe
"C:\Users\Admin\AppData\Local\Temp\4524c0797edf095a4902fb1b278b9846ec012d54bd89939870e75ea94a51d4c2.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4524C0~1.EXE > nul
  2⤵
  PID:1620

C:\Windows\Debug\mewhost.exe
C:\Windows\Debug\mewhost.exe
1⤵
- Executes dropped EXE
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\mewhost.exe

Filesize
196KB

MD5
6750d3f3980122b003d4d7e8d4b9afd3

SHA1
7659583ea9a3b93748edbb02a4ed2f9ed148ec46

SHA256
cb27ccd6ffa2378073a7186b99f4046b6ef2f342e9e7e385e00b28612bf3475e

SHA512
13e29d02340ff23ec243b4a83a1e6769ade75bd77eae743b0e50db2253f0833e48507ed69fde5d4fe44924544bbb61084deed19fa14307f9081b5818dbd3fc55

Download Submit