e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe
Size

43KB
MD5

9b9e03239baf7feeb99bb8a81c46b5ac
SHA1

69f7df50c7a5d5217c6bb8f0e1b2b10ba49d4aac
SHA256

e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d
SHA512

dd4a34327919f8c8137ad9148a8cc729b00a4c835ae3cac07d0a431ece86e95f030a3e6563750e11d0b120e22af23b12487bb4d58ff056e0f6cea2d60bdb0b05
SSDEEP

384:MZcaoPBXkIq5ozV/EYSfyoj464UGoqxAJqeGcuqVp:MiPPTYiNofyoj4lUGTAtSsp

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x0007000000023214-5.dat	UPX
behavioral2/memory/4068-9-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe

Executes dropped EXE 1 IoCs

pid	Process
3428	hromi.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0007000000023214-5.dat	upx
behavioral2/memory/4068-9-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3428	4068	e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe	88
PID 4068 wrote to memory of 3428	4068	e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe	88
PID 4068 wrote to memory of 3428	4068	e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe	88

C:\Users\Admin\AppData\Local\Temp\e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe
"C:\Users\Admin\AppData\Local\Temp\e41dfd370215455c4df364717103df492c6fea5f86aea33641c504069804146d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hromi.exe

Filesize
43KB

MD5
cc6210aa49ccf93891e4ff034566aa04

SHA1
7add83a12032e636590822730c488d6767817915

SHA256
b794b6c2a76ba73135f785a4ce69384253ae0e245a7f85933a2c6a4c50a10895

SHA512
16baaca9131313a564454c2983e7dbe579bedd0d73a865019774aa3b6c7d0943d01313a70438b64ae60af499015f81cce365f2e7a4865ca3fe4af090b0cef4d0

Download Submit
memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4068-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download