5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe
Size 158KB
Sample240323-ze679aef4y
SHA256 5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943
MD5 651a71adb24e0b6733d079cf98abf3e9
SHA1 9c97a611e9eb3a289e34d28cbee017ebfdc31b68
SHA512 cf37aacd7d6fcc98ed6a5f7bc9e031b703e18862c9dd625127f177c51adc91fdddfa9d7f6027c344fd97bc66d55ab2faf1313471d3f8f95b05042bd5a6d5db35
SSDEEP 1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcU:nVlUPZRxfxE9Vs5cfdd6YGGIU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5040	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	92
PID 4324 wrote to memory of 5040	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	92
PID 4324 wrote to memory of 5040	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	92
PID 4324 wrote to memory of 2284	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	93
PID 4324 wrote to memory of 2284	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	93
PID 4324 wrote to memory of 2284	4324	5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe	93

C:\Users\Admin\AppData\Local\Temp\5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe
"C:\Users\Admin\AppData\Local\Temp\5480bfde66c1ca400dc6174398089b1c0ea07635c825d37998779ed9198dd943.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

biudfw.exe

Path C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Size 158KB
SHA256 a0d2349a3a9e5aca78df92bebfa80013649cdd039d76577a5dc671d7d868b76f
MD5 ea9242f82bf00dc35f25cafe28f6941c
SHA1 2336522fea2af09ca92d48078c1449098fe50200
SHA512 072505c98983e3e9c72c44c5eddb1b86e75e5937742c5a2c0dfce969c7f476825cc94fe6163ec78249a4b0ce7e833156bb47ad9eb3580e009f8e53899b71e64f
SSDEEP 1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcU:nVlUPZRxfxE9Vs5cfdd6YGGIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37
MD5 a250860c0687ed9dda488805c025a2d2
SHA1 0c181ed3b46463d35631ca169f0928c33a1da389
SHA512 0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a
MD5 SHA1 SHA512

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 338B
SHA256 6c7049f537a263dac61af19bf0a8b8fbaf4b3c0864dc5432eceff2dc21d84190
MD5 1b361d2667d33aca887bf7b9683e8964
SHA1 890cd0659601bc34da4b590bc6376a9990af5a63
SHA512 e2a9342d04999b979212b9a28a719d82e374a9cd30d115df2c80f576cb33676d723b2a90fee9397d28ebca444b4355261ba1b0762c1bfa897a9d739abbd765fc
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads