3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe
Size

54KB
MD5

e1ac355763a4b5a82ca4e2797cabb4f2
SHA1

0d5977114dafa5ccbbf2e052c3eda766a8b81d1d
SHA256

3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44
SHA512

d0cd53745da4b45d967e8aca89ea15d537877b85a51ffee698bd79f91a89cde12830d854eee92360bebd0e008b10a530737a9521b83ad88c268ded3729501084
SSDEEP

1536:NLI4qg9+Q/KMJqSsGpdNmLUIsWsdM5T233A3:Bb/jq0LNmLUIsWsdM5T233A3

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	bsahost.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3640-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/3640-3-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-11-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-12-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-14-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-16-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-17-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-19-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/2848-21-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\bsahost.exe	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe
File opened for modification	C:\Windows\Debug\bsahost.exe	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bsahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	bsahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3640	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4924	3640	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe	90
PID 3640 wrote to memory of 4924	3640	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe	90
PID 3640 wrote to memory of 4924	3640	3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe	90

C:\Users\Admin\AppData\Local\Temp\3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe
"C:\Users\Admin\AppData\Local\Temp\3dbe0aeaa2d69f085eb0f85b063f0fcfaaaabbe0f97c7aec27d03a5972573a44.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3DBE0A~1.EXE > nul
  2⤵
  PID:4924

C:\Windows\Debug\bsahost.exe
C:\Windows\Debug\bsahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\bsahost.exe

Filesize
54KB

MD5
0d1ab21f006f78f1e3430365df8435b5

SHA1
4ce8a4bd3aadfa1f020812550c4895f77193722d

SHA256
f5dd620c1dfcdc1eb8a8e0e417dc24194d11b3eec0e574c1568f442ab28172d9

SHA512
2309bf59ec8354d6085e76210b4de8f732e98200c9e12c0fbc69a2972e81dd8c8391554a4cd28a31c9565390b5229cf877a139695eaa14a76a86de4bd944411d

Download Submit
memory/2848-11-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-12-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-14-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-16-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-17-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-19-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2848-21-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/3640-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/3640-3-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads