73cccda0ab4c21807fee9b109c892a56a4ea992a38205eeaebfc93a950d6dcf9

Analysis

max time kernel
149s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0975eb35380a009ab410fb2b986d7e92.exe
Size

75KB
MD5

0975eb35380a009ab410fb2b986d7e92
SHA1

5e2e21f42a873f9b23ea69ca97340f7bbe49c816
SHA256

73cccda0ab4c21807fee9b109c892a56a4ea992a38205eeaebfc93a950d6dcf9
SHA512

e82b5f217c2dee3bcd5e91e83ff26a55f677a443b573f5395b04ff4f5914ed8ca0bd15d670955d927ac2ef0ab2aaf3081b9f10a844db7e5a9f39fa5644152f02
SSDEEP

1536:ttjS70CZJ4Ke2NuLVRfSdRQykqQxuMZztO/bK4LsKLD7:L+7nP1kfSdRBQxu/

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	0975eb35380a009ab410fb2b986d7e92.exe

Executes dropped EXE 1 IoCs

pid	Process
2812	lifikuri.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2812	4432	0975eb35380a009ab410fb2b986d7e92.exe	88
PID 4432 wrote to memory of 2812	4432	0975eb35380a009ab410fb2b986d7e92.exe	88
PID 4432 wrote to memory of 2812	4432	0975eb35380a009ab410fb2b986d7e92.exe	88

C:\Users\Admin\AppData\Local\Temp\0975eb35380a009ab410fb2b986d7e92.exe
"C:\Users\Admin\AppData\Local\Temp\0975eb35380a009ab410fb2b986d7e92.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\lifikuri.exe
  "C:\Users\Admin\AppData\Local\Temp\lifikuri.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lifikuri.exe

Filesize
75KB

MD5
59fb7ff29a4f802f436316d040dc4ea6

SHA1
16c13c41e02be5a10f3c3a5cf4808702bedf8df3

SHA256
cc111bb6a1b5fbcd0f44102e434f42b2a72b76f0249932a8d9e84d6e0d4388e5

SHA512
17abfbc1954c8b4452aba0149b6242201beb1f43c5ebd173e841abed03356c6eefe4e4fd694290f684d49fafcfd68c965dc3857bfa54900ff1cc79a42a9e83c6

Download Submit
memory/2812-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2812-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4432-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4432-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4432-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download