6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Trojan/9reset/9reset.exe
Size 385KB
Sample240316-sns9esdf21
SHA256 42785338860918c7caeb035d8f5689e258a1768db1650cd4758ac595a5c6a2bd
MD5 d05daaa1e1b95fa203891321f2345540
SHA1 e05de699d799c1366c0d0285a4c0395aa9b69fc9
SHA512 fc63d87da773f145482a2d61d1583ba1f4ec76761522092990d83f710c9f282294d1f83948318a37678c5bd5e3f178fca7a07e6c0cd36643ab17b37902997f3d
SSDEEP 6144:9t5hBPi0BW69hd1MMdxPe9N9uA069TBxq/:9tzww69TLK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	9reset.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2224	2676	9reset.exe	91
PID 2676 wrote to memory of 2224	2676	9reset.exe	91

C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4759.tmp\475A.tmp\475B.bat C:\Users\Admin\AppData\Local\Temp\Trojan\9reset\9reset.exe"
  2⤵
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

475B.bat

Path C:\Users\Admin\AppData\Local\Temp\4759.tmp\475A.tmp\475B.bat
Size 85B
SHA256 31ee6e28c82ab165ca3048aec9a88c8590d6f0b94b88e7f87b6ec36d2fa0a24c
MD5 f2d5cf0bf3d6ec8c6d5dc97af835c5e5
SHA1 5b60f43fa6d5810bad58de5f06a0f84dd4aa9bf6
SHA512 075fb8005c93d9f61dfa07b41424591ff518a6f9c8a1fff74d1e6df39ec56377e48208e08a01485eafeced2880a4b18061ddfa637611a89ce3f252580c2deff9
MD5 SHA1 SHA512

Submit Download