813dac69f9fd245fb1f8d4cd315aff8a0c1d0e38de36d955317ae37e31228b8d

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e206bbe2a12cc7d2213b169fbdc39ef.exe
Size

49KB
MD5

3e206bbe2a12cc7d2213b169fbdc39ef
SHA1

dd0cfe7f3dd8025f7ba4ac73a0be94a055ac4441
SHA256

813dac69f9fd245fb1f8d4cd315aff8a0c1d0e38de36d955317ae37e31228b8d
SHA512

a2e0a37d3ed74454deaae2e62e806efb1587efec536faeebc42ba49aa85ac5a92af657027f8823cc8993e8d98134eed04885b8bf24e33f3923abbf733de27686
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxd:X6QFElP6n+gJBMOtEvwDpjBtExd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4123566616-543693798-272350410-1000\Control Panel\International\Geo\Nation	3e206bbe2a12cc7d2213b169fbdc39ef.exe

Executes dropped EXE 1 IoCs

pid	Process
4608	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4608	1524	3e206bbe2a12cc7d2213b169fbdc39ef.exe	86
PID 1524 wrote to memory of 4608	1524	3e206bbe2a12cc7d2213b169fbdc39ef.exe	86
PID 1524 wrote to memory of 4608	1524	3e206bbe2a12cc7d2213b169fbdc39ef.exe	86

C:\Users\Admin\AppData\Local\Temp\3e206bbe2a12cc7d2213b169fbdc39ef.exe
"C:\Users\Admin\AppData\Local\Temp\3e206bbe2a12cc7d2213b169fbdc39ef.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
0063719ade06ff987d4d80dbb29268d9

SHA1
ca9e5b9420de6c7b26e348503f5ff59a6feb2bb0

SHA256
ab9a6edcc26696685c8a0f12441e78a21d12b6226153634e304eb889e69e9017

SHA512
dee604ddf043883ac17949c3baaf166df5c57604dd8ce030349d80544373e274d86c6dc99eb0f2d0bdc6e601a21492cd4ef47cb8604dd28f9a136852f4b595b3

Download Submit
memory/1524-1-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/1524-0-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/1524-2-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/4608-17-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/4608-18-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download