7ab28dc46d87a2d236e6efc7b45d96c347b5d7a0c7cda85e07e34b151b693521

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603daa32a8773ad074d9ec4ba9672cd3.exe
Size

68KB
MD5

603daa32a8773ad074d9ec4ba9672cd3
SHA1

18220eb77fc3faff8451903858d873511b79f490
SHA256

7ab28dc46d87a2d236e6efc7b45d96c347b5d7a0c7cda85e07e34b151b693521
SHA512

acb6db3dac6caf4fae2f70e80bf4f568c72e9ee86fd4d93bcfb750bfb9b7c6c2efcae232749425202017cc83f7014d7ec2159502d66be91d92c287e875568cc9
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUsS:DW60sllyWOtEvwDpjwF85j

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	603daa32a8773ad074d9ec4ba9672cd3.exe

Executes dropped EXE 1 IoCs

pid	Process
1632	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1632	4888	603daa32a8773ad074d9ec4ba9672cd3.exe	84
PID 4888 wrote to memory of 1632	4888	603daa32a8773ad074d9ec4ba9672cd3.exe	84
PID 4888 wrote to memory of 1632	4888	603daa32a8773ad074d9ec4ba9672cd3.exe	84

C:\Users\Admin\AppData\Local\Temp\603daa32a8773ad074d9ec4ba9672cd3.exe
"C:\Users\Admin\AppData\Local\Temp\603daa32a8773ad074d9ec4ba9672cd3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
68KB

MD5
71af6a38f9d0e72db04d0667442fd4b1

SHA1
bcd6f0be38dcd3163ffcb2017c286d914014dffe

SHA256
76d9675507e824d60aef08de275c91e16d0b9e5b085ee1d0058b0e29081eb436

SHA512
3dbab597ec5f104af9aeb19953ecbde2d914b13c684e36d71dcb37815b176cc577982d28969ba6a4585e131fc80d3378b5b3c77d64dc61908a78ccb9769b7abf

Download Submit
memory/1632-19-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/1632-25-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4888-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4888-1-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/4888-2-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/4888-3-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/4888-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download