c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe
Size

48KB
MD5

c030d2045bf4fa21ba0957c327fdd835
SHA1

19920430d911d5ce1504688665771ec8a3062e5d
SHA256

c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a
SHA512

ad03a66594f5960d5a570ecf09c43d57bad8275b55b788710690d481a7638d2ef626258911b495b2305a76e4d6a7e7e72494cccf1673c71373387a89a804e3b1
SSDEEP

768:l2EMQWlqBxRlHzZN2zJo3LeivGnCoPToFr1t6nV863:0lqBxRlHzZN2zSPvDoPTojt69

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	laccm.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	laccm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4032	2116	c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe	86
PID 2116 wrote to memory of 4032	2116	c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe	86
PID 2116 wrote to memory of 4032	2116	c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe	86

C:\Users\Admin\AppData\Local\Temp\c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe
"C:\Users\Admin\AppData\Local\Temp\c851f428eebb83f88ccf77f0ddf2f32fb08261b9bf7d890a512cff1e6f60077a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\laccm.exe
  "C:\Users\Admin\AppData\Local\Temp\laccm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\grias.exe

Filesize
59KB

MD5
bcd7d80a843c1ec00e8e740f3073f23a

SHA1
07494163298d4657c55dd25a2f6f4814bdc5c04c

SHA256
ba6ed73e5cacf4d71ac28861b74df167c68e5c1e045a1573e9bbcb7820d12cab

SHA512
6105655c146928db70b52332113793b4d2af97a3859c147f02a27c5733fe7217ed3e04b833e8169f03bb1a9d3c9bf50caa0369f9efb18cf42ecc504d66a0faf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\laccm.exe

Filesize
48KB

MD5
ab882615518afc32ebd9707d09cf30d3

SHA1
278ec53062aa47754c8222655bf5af2446a05a91

SHA256
9f2810ceed545109029d629485167ef5fffa0666cc85fbd2d9481323932e18f7

SHA512
47cb411722b62f6bff09d8c9ec7d8a3cae26ab9ba05093adc87126f43ad55e16329ed5f00cd94d4384b52bc76aef37a52c1dccc6e174833ecd70006ea3099ab3

Download Submit
memory/2116-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4032-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download