6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe
Size

27KB
MD5

9f336b1d6d9490b9cdfce01aa0a96c0f
SHA1

4836e208167bd053c0c5db8b0eea763cb1e45710
SHA256

6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f
SHA512

33cb359ab6c5b65075807ca4d13c112623b9f7c3b9f426f0f8218f0c56c992e2d2c18d78c1f27a1060f38dc41e827b46b9c161f35acc0183052f32a41784b568
SSDEEP

384:6o7fwUYLh2QbVXn8LmA43/29aSJG7GgawGW5IYheQ:DkLNbcnraSotsWDYQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe

Executes dropped EXE 1 IoCs

pid	Process
4180	qagin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4180	2440	6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe	84
PID 2440 wrote to memory of 4180	2440	6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe	84
PID 2440 wrote to memory of 4180	2440	6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe	84

C:\Users\Admin\AppData\Local\Temp\6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe
"C:\Users\Admin\AppData\Local\Temp\6bea5f724b16c236fc9071804189ddcd94ff0ff3767bd96ea689bbb0db2a958f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\qagin.exe
  "C:\Users\Admin\AppData\Local\Temp\qagin.exe"
  2⤵
  - Executes dropped EXE
  PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qagin.exe

Filesize
27KB

MD5
fe684e3c9036477e4c0a5d344ecc5fc5

SHA1
1659f7f02f4c5419eb07f0337c4f9bd307e0c52c

SHA256
7eb146aeeefec6a9bb3e2f46d5da80128523fcc46ad76c24c9279351c649d272

SHA512
e1a6fdc6a1f349af1d6df086896f5eae8a796fdc8f27f45f19fe6cff03c8326f1ec79d22147e2a136490d13a46521364cd233eb7c5d314a615e9b1e4d2b7974e

Download Submit
memory/2440-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4180-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download