Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2024 02:34
Static task
static1
Behavioral task
behavioral1
Sample
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe
Resource
win11-20240221-en
General
-
Target
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe
-
Size
106KB
-
MD5
fe380780b5c35bd6d54541791151c2be
-
SHA1
7fe3a583cf91474c733f85cebf3c857682e269e1
-
SHA256
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
-
SHA512
ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
SSDEEP
1536:lIpbrxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPpe5xKOcuS11Phbiyn2TCf:KpbrsISnRGPJkGt74GsISnRF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.execmd.exedescription pid process target process PID 1208 wrote to memory of 1584 1208 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe cmd.exe PID 1208 wrote to memory of 1584 1208 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe cmd.exe PID 1208 wrote to memory of 1584 1208 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe cmd.exe PID 1584 wrote to memory of 3244 1584 cmd.exe PING.EXE PID 1584 wrote to memory of 3244 1584 cmd.exe PING.EXE PID 1584 wrote to memory of 3244 1584 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe"C:\Users\Admin\AppData\Local\Temp\b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30003⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-1-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/1208-0-0x0000000000C40000-0x0000000000C60000-memory.dmpFilesize
128KB
-
memory/1208-2-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/1208-5-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB