d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe
Size

45KB
MD5

f114ed3797fab278ee6ccd439ecee276
SHA1

9a7537ed4ec3a4f4d3a19c50d49797846b10ad1f
SHA256

d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85
SHA512

3f2727b18f07e61abb03cd88825380b07a6bbf38bdf9d7be97cc670cd2a0dcb90eb344e24f91625d7df4789e3c8444398a199fecd9d7f908843fb3b3b5a99756
SSDEEP

384:/opQWRIg8e+6U44d1XxfvAHbluRSbVL1+LIh/WP0ZysgLOaszrQ:/0hR6VXxfvAHbEPIXIssdsfQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe

Executes dropped EXE 1 IoCs

pid	Process
936	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 936	1432	d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe	89
PID 1432 wrote to memory of 936	1432	d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe	89
PID 1432 wrote to memory of 936	1432	d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe	89

C:\Users\Admin\AppData\Local\Temp\d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe
"C:\Users\Admin\AppData\Local\Temp\d06feb3d2f1ac98bd8e563e9fabb2077028a41bc48499ea6adf2a61afe699f85.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
45KB

MD5
1ba8960cb62a1c895359c885d38fdc93

SHA1
8c578f441a00d233a862d8ea8f2a5939b45bc914

SHA256
9d023ca409375052390c5e3a2355eb4ad1ed9eb848b13df143e90b411cd85bc0

SHA512
25421f3d3ccebeef89cd3b93a4e5acaa92765c109b15f0f0d79e64c7235bdb00c22fea47edfcc982a5fd5b0cbf3041ba9ea9f7af70c22928fdbb3f15bcfc02bf

Download Submit