d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe
Size

41KB
MD5

2d183cbadd6f9f3d515fde4a5cb314fc
SHA1

6d7614b14c7e7a85e16ac9163ab87978218381f5
SHA256

d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4
SHA512

6ad24f1221591905a47a4635c20cb2507a06ca045757ba6eeb9e56206ce7248c88113233807c63fd3ef120d5ee82f123d73c72b8a6705086eec9e4c8e2ba3ed9
SSDEEP

768:8Qv/YOZIgQtz8GEkT9oe2lxUCuwE3u89MtdEI2MyzNORQtOflIwoHNM2XBFV7WBx:tv/pZIgQtz8GEkT9oe2lxUC9E3tMtdEE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	hromi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1764	1916	d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe	89
PID 1916 wrote to memory of 1764	1916	d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe	89
PID 1916 wrote to memory of 1764	1916	d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe	89

C:\Users\Admin\AppData\Local\Temp\d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe
"C:\Users\Admin\AppData\Local\Temp\d5818245fca450238868ab2907f69688025060ede4011fe017b682bb239a90f4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hromi.exe

Filesize
41KB

MD5
a5b917495f726fdf80846fee139ef0ed

SHA1
167285a6c558afc39c6427820706cd2b7abd21d1

SHA256
40ba660480785ad3510c826375e53c44d6e39dbc3bb700fb9064e6f70466ea39

SHA512
01c2531ec37994e8562291eaae002a70db7388fb03e6afeaaa4cb6766d7dc56a89f073ee3b7fc02ce09c8060e3b2f510a4fa2c517a8e565a91cf36274bbf1af6

Download Submit
memory/1764-25-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/1916-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1916-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1916-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download