0ddfef075612e1102fd7e751ab175ab37e03c3349500c05d523854e84cc26f59

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7031d8d1817af4384e62cd1de4d120e.exe
Size

52KB
MD5

d7031d8d1817af4384e62cd1de4d120e
SHA1

eeca7ff180ecd9b2782d7c46a9e9d6e5df63265f
SHA256

0ddfef075612e1102fd7e751ab175ab37e03c3349500c05d523854e84cc26f59
SHA512

0d2dab1f891b9439c360be09c102a7c30429210c1904afc4304999684a033acb222527c73e18d02b9eb79e34e9f6f9403255953337bcc6c94409864b7f8a29ee
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakl7:V6a+pOtEvwDpjc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	d7031d8d1817af4384e62cd1de4d120e.exe

Executes dropped EXE 1 IoCs

pid	Process
4792	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4792	884	d7031d8d1817af4384e62cd1de4d120e.exe	86
PID 884 wrote to memory of 4792	884	d7031d8d1817af4384e62cd1de4d120e.exe	86
PID 884 wrote to memory of 4792	884	d7031d8d1817af4384e62cd1de4d120e.exe	86

C:\Users\Admin\AppData\Local\Temp\d7031d8d1817af4384e62cd1de4d120e.exe
"C:\Users\Admin\AppData\Local\Temp\d7031d8d1817af4384e62cd1de4d120e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
c87bda812d973f61d7066ab1e134de39

SHA1
9ab9fd446fdccd23f668aecb0ce833bc503db08b

SHA256
f247e31ea35f86f1679570bf0a537fd50985ad5c19a869d9deb3bed9345be524

SHA512
3eac0b889eb74c23013bed3915708526eb8b446daa998ea923777e7287da6f2f92ca25007a852e6f93d92fb8507ebad72a54274694e29eb90d737c7fbf0bcc9f

Download Submit
memory/884-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/884-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/884-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4792-17-0x0000000001F50000-0x0000000001F56000-memory.dmp

Filesize
24KB

Download
memory/4792-18-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download