0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c

Analysis

max time kernel
137s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe
Size

90KB
MD5

3ab7c7112b2391561164bf667afed03b
SHA1

9bd258958778997f8cccd51b59f6b69d28e3b329
SHA256

0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c
SHA512

d13082c4645434989686928995c7938a5f8545f4cf9ae9f5001ac808b1975b318dc393b243bfba297bda76441b1d051f47bdd01ef6a703a59a6c445982e478e5
SSDEEP

1536:jeXTIS4jXepeE1a5VI4To6JfYBEb2s8Qtbl31UjB3bcebKY2/:jTS4jXO4TFMEnRG1oeS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe

Executes dropped EXE 1 IoCs

pid	Process
1504	apsoct.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1504	4888	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	94
PID 4888 wrote to memory of 1504	4888	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	94
PID 4888 wrote to memory of 1504	4888	0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe	94

C:\Users\Admin\AppData\Local\Temp\0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe
"C:\Users\Admin\AppData\Local\Temp\0a81ae3de62f0e798a085c2b0a819dee6e1caea7c0fcdb5d7285acc795a56f0c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\apsoct.exe
  "C:\Users\Admin\AppData\Local\Temp\apsoct.exe"
  2⤵
  - Executes dropped EXE
  PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\apsoct.exe

Filesize
90KB

MD5
decf8e295bc6b0ce4b02bfb4c29e8c36

SHA1
13dc93d194635dfaba2c323158b18b88107b266b

SHA256
9fd1370762309e18b32ed773c0aac717acb5ed975743412d7287bf7ccb0356ab

SHA512
a4d211ba7cd07554d0330def40226b60d7ae6884998b72c11bfd23c2c3cb950a43cc946608992d249997ae05a666d186501649327fdafc040c6f861be2d091a0

Download Submit
memory/4888-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4888-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download