2ac9b229df3c7976617ff0948a52cd0ebe29589ffcd931f09417b16a4f4502b7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5aee55384e370dc15b1f5096e0f86e0.exe
Size

48KB
MD5

b5aee55384e370dc15b1f5096e0f86e0
SHA1

a2818ec5d6e44046b5223091392c079018091e00
SHA256

2ac9b229df3c7976617ff0948a52cd0ebe29589ffcd931f09417b16a4f4502b7
SHA512

fe1cd15d3a9194a910e8ee5f274bfcd30f11fee4ed0bfa51f229d64843dfd22e7743ae1be5703a5d0891cfdbebb75a9ad9960045d3538b815f47220a5d44e4bb
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaNg:xj+VGMOtEvwDpjy+T2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	b5aee55384e370dc15b1f5096e0f86e0.exe

Executes dropped EXE 1 IoCs

pid	Process
548	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 548	2700	b5aee55384e370dc15b1f5096e0f86e0.exe	84
PID 2700 wrote to memory of 548	2700	b5aee55384e370dc15b1f5096e0f86e0.exe	84
PID 2700 wrote to memory of 548	2700	b5aee55384e370dc15b1f5096e0f86e0.exe	84

C:\Users\Admin\AppData\Local\Temp\b5aee55384e370dc15b1f5096e0f86e0.exe
"C:\Users\Admin\AppData\Local\Temp\b5aee55384e370dc15b1f5096e0f86e0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
49KB

MD5
24ac63ec0af8a172288e24a1eb356a24

SHA1
ceda760ea9c37b12b809c0632c75f6a05a39786d

SHA256
717e44e87a9b69dac0e3be0f6a4b222fe9ef2f1c53354913d3bb55796b6f4ca2

SHA512
35d9f91da97191024d1bfa7b2ce75bd943d36f02e0cc1c8594df03ff0603c51e190d990836f69f7b727b56b96a3602cd71308bb05f6fdb0f6f1a5d5f2a89ca4e

Download Submit
memory/548-19-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/548-22-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/548-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2700-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2700-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2700-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2700-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2700-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download