c2ed76e4e55d68416bc1ad04d12e348f8cc7126873904a8168830771cf1810ef

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0620eb549ecaa7ac5c13e3fea9b92e4e.exe
Size

116KB
MD5

0620eb549ecaa7ac5c13e3fea9b92e4e
SHA1

90cfcf4fb22c59f170b9a8325d678639f7cc8edc
SHA256

c2ed76e4e55d68416bc1ad04d12e348f8cc7126873904a8168830771cf1810ef
SHA512

7b05e16e7a42022dbb1d9459459e7b7e294244639dced94ccce92c4fd15311728e60ec9ab6e8f5d68deeeb79a47b47bdbd2ec7ae88a241e4c72e8d27b8111c4b
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNgerar/cH:T6a+rdOOtEvwDpjLz1

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	0620eb549ecaa7ac5c13e3fea9b92e4e.exe

Executes dropped EXE 1 IoCs

pid	Process
364	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0009000000023224-13.dat	upx
behavioral2/files/0x0009000000023224-16.dat	upx
behavioral2/memory/364-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2824-20-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/364-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 364	2824	0620eb549ecaa7ac5c13e3fea9b92e4e.exe	87
PID 2824 wrote to memory of 364	2824	0620eb549ecaa7ac5c13e3fea9b92e4e.exe	87
PID 2824 wrote to memory of 364	2824	0620eb549ecaa7ac5c13e3fea9b92e4e.exe	87

C:\Users\Admin\AppData\Local\Temp\0620eb549ecaa7ac5c13e3fea9b92e4e.exe
"C:\Users\Admin\AppData\Local\Temp\0620eb549ecaa7ac5c13e3fea9b92e4e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
116KB

MD5
dbcc79cb89c12cd94def06086e52d89e

SHA1
43a4a8bfb34fc1ed1c5ae54fb2143090d8b986bc

SHA256
f5347229adb5026ef16f276403beb3d09016c625a63d1718cd1020043215cd1e

SHA512
181b10925df1fe255f63fa4496ea71e744cb290e479275591d98ceb98d4bd5bdcf4bd034250ff3660aecbfe422e85b461fce7455660a8d12873cf4902d26ce1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
c9f6bc180ea5d8825434b1d6f2609012

SHA1
216438285a2c758c2938bdb48ea7bc7181a797a9

SHA256
9f06123162a44a7b06d1624701c08caea15390cf0f25696d727b83b89bd18138

SHA512
eb4b300edc6a61e9ede84a48f07ba0a9fe55f9b30ee839d5c8f3032513b08f56ff1ae55b013d1030edfd0952e69fc2f36269fc03c51ef51506ddf7f7f2756d6e

Download Submit
memory/364-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/364-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2824-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2824-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2824-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2824-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2824-20-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download