2588d897f60a7b5d9f74332d7078b4abd9152844ff039292d5e2dc81652ca09c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54a96e40b86f3af78bad24e9e3cf579.exe
Size

48KB
MD5

b54a96e40b86f3af78bad24e9e3cf579
SHA1

d26251f4d8687e5394b0c9c75044e3009e1db472
SHA256

2588d897f60a7b5d9f74332d7078b4abd9152844ff039292d5e2dc81652ca09c
SHA512

53425a5f6b14755956cdca51e2c7df8998eeb184d8ed788eaa052ed6529b9beb24d9b91aed428802be150581129768dc4ff5fbaed0c414538c1cc3458ca60106
SSDEEP

768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmxX:24Bobv7aB0EooYEC3rUVcYX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	b54a96e40b86f3af78bad24e9e3cf579.exe

Executes dropped EXE 1 IoCs

pid	Process
4048	zbhnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4048	3620	b54a96e40b86f3af78bad24e9e3cf579.exe	87
PID 3620 wrote to memory of 4048	3620	b54a96e40b86f3af78bad24e9e3cf579.exe	87
PID 3620 wrote to memory of 4048	3620	b54a96e40b86f3af78bad24e9e3cf579.exe	87

C:\Users\Admin\AppData\Local\Temp\b54a96e40b86f3af78bad24e9e3cf579.exe
"C:\Users\Admin\AppData\Local\Temp\b54a96e40b86f3af78bad24e9e3cf579.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
  2⤵
  - Executes dropped EXE
  PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zbhnd.exe

Filesize
48KB

MD5
57674243a1b86e7adaa1a12abbefee2d

SHA1
977c314c397e986d8b9350adace9fe7a87021f66

SHA256
6933e3f6beb90d30a21e654ab838563389fa42f17475cb969006f2d484081e18

SHA512
07cfcd6c7f593f7b777fe403d5b4daf57d8d50e4e83b92f845d3aa9f02f251565117143e43870ff821578ad346bfc11b32de942207dd5efc2dd2ed645725208e

Download Submit
memory/3620-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3620-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4048-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4048-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download