59a9a2c9b21eea3211e02d76c0688a1fd3a2dac18c14b24cb935d952db33eba2

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9bcfcd69aacae894fe1de73ce1cfcb5.exe
Size

94KB
MD5

b9bcfcd69aacae894fe1de73ce1cfcb5
SHA1

43da576daa85e4c2cf0496c0097bcbaba1a3b8f1
SHA256

59a9a2c9b21eea3211e02d76c0688a1fd3a2dac18c14b24cb935d952db33eba2
SHA512

91ccd45e379919d07c7e1dafa6389f2910caf95da084cefc688d93ad4092582ed923922dfe259ffbaf4a43cdf3482c8ef8db1f8d9ba429ce0b250bb7e3796b3a
SSDEEP

1536:89c//cQk4w68KXJnml4KBMrlx764OMGDoFVa2FwFIy:0cMQk431mulRPEiETFIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	b9bcfcd69aacae894fe1de73ce1cfcb5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1788	4272	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	95
PID 4272 wrote to memory of 1788	4272	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	95
PID 4272 wrote to memory of 1788	4272	b9bcfcd69aacae894fe1de73ce1cfcb5.exe	95

C:\Users\Admin\AppData\Local\Temp\b9bcfcd69aacae894fe1de73ce1cfcb5.exe
"C:\Users\Admin\AppData\Local\Temp\b9bcfcd69aacae894fe1de73ce1cfcb5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ulv..bat" > nul 2> nul
  2⤵
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ulv..bat

Filesize
210B

MD5
cbbd216ff2a6a2e96bc9bce2ece4aa20

SHA1
7987a468b6ff1cb3dc9463294539dd7aad3850e7

SHA256
5f832c8df93df0d3469f033afce17d5a0aef50efb737cd00dfb0da104e323c31

SHA512
08ac84bf7ab0e61375434b354f13b2bb3d9fb2cff98b66743626b57e964824fcdbe427d52104b560b9bed97877dead61f4311c53aadb59e0f33eaa50ce3911dd

Download Submit
memory/4272-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4272-1-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4272-2-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4272-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4272-4-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/4272-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download