e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe
Size

26KB
MD5

a798808dc4731be243b4b2a6484019d8
SHA1

158c96477459a4346560662fe1c8922d69ba4bec
SHA256

e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114
SHA512

4d828617eabc40acdc5fc289c3039ce69b82899c6fcd9c7a755249be2026a8f8ac40bc6c8caf423b2bfd853a3310ccdef0b056b73844817579d2d885d93332ce
SSDEEP

384:uhLCP1R8XnzvuwT0pZwBeH7lQDizU11u54TV0Lv:cCcvuwU6eHhQDi41U4TGLv

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	codecupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4092	4468	e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe	91
PID 4468 wrote to memory of 4092	4468	e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe	91
PID 4468 wrote to memory of 4092	4468	e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe	91

C:\Users\Admin\AppData\Local\Temp\e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe
"C:\Users\Admin\AppData\Local\Temp\e3148febab45b359628c4b86fbd7ed442b6ed2bb6c4b7475eadb4e3750931114.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\codecupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\codecupdater.exe

Filesize
26KB

MD5
7921bfe216ec4de97c23c19c3fd84328

SHA1
b2ccf8d80cf24087a748b405ddb11855a06ec9af

SHA256
9b49e7a2b4d75ab76a78884e548c3b5bf9eed354a88779c58eb00e2f1fe8758a

SHA512
ee50678619ec4e382d7c05760ce7189329d2f9300f0b5a6c933ab99998071d21f890882e4c9ac27bcae3891b190115050fd1d5fb5f32ada37fbc1d189ac3c3e5

Download Submit
memory/4092-9-0x0000000000610000-0x0000000000619000-memory.dmp

Filesize
36KB

Download
memory/4468-0-0x00000000009A0000-0x00000000009A9000-memory.dmp

Filesize
36KB

Download