9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe
Size

21KB
MD5

238c98ee0f3754b5757e2136815a360e
SHA1

f55d69991491011a11fb9a31a6b65236519ef325
SHA256

9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e
SHA512

9aee0b08baef532496088b56bddd6aa14ece13631dce296ee44d14f6810a928c6e4520e68466fe518ce5fa92930edf56ba74799004f7edf18ed9c29ac8c85cdf
SSDEEP

384:QLcTQvmFzKbP1SKQNFBDfUvwlx4o43CO+8rk8hS7p2o/AYWU:QqQmFKSjY4so4L+q22oIxU

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	fcbnaf.exe

Executes dropped EXE 1 IoCs

pid	Process
4988	fcbnaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4988	5088	9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe	86
PID 5088 wrote to memory of 4988	5088	9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe	86
PID 5088 wrote to memory of 4988	5088	9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe	86

C:\Users\Admin\AppData\Local\Temp\9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe
"C:\Users\Admin\AppData\Local\Temp\9509f858a33a380e692353ee5d8450eb1644a15e433eeefdb6d81e9237030a6e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe

Filesize
21KB

MD5
def48c5dec9274abc2c8ebfac7739269

SHA1
e62cc2d85b202bef4ccf9dff67b6345596b06c41

SHA256
36b82321da47bc31802ac3a320e53ce1c2dccd2ca4b0db320925f548adeeca4b

SHA512
72e4289a1928ff9e4d73ea897bb33414810034ccffada4d7703e327dc5d9607e0d857bf963f44c3c6b1e1429350526ae68bf2692274074eb82a443e54f8befd1

Download Submit
memory/4988-9-0x0000000000640000-0x0000000000680000-memory.dmp

Filesize
256KB

Download
memory/5088-1-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download