31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe
Size

31KB
MD5

e69efc283c06e8141a705546b8cfba99
SHA1

f886341d050d59b39d435c222071268d628308bd
SHA256

31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686
SHA512

f11d4305a7ee7afee3fc36f7751f95b32e5e63027a5d6515ee8317d77c8c3375d71657ac4d821fcd450d99899286ec92234d934bb3e9637142bd481ff0e105e1
SSDEEP

384:tGx04wzHycMnzWHr5r9Vc5lxr8gPkijToDeYBWX2SENkNSflyzDrmElW:UxHc0Im/8m9TMe+WGFUSflyyEY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe

Executes dropped EXE 1 IoCs

pid	Process
3648	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3648	4364	31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe	86
PID 4364 wrote to memory of 3648	4364	31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe	86
PID 4364 wrote to memory of 3648	4364	31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe	86

C:\Users\Admin\AppData\Local\Temp\31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe
"C:\Users\Admin\AppData\Local\Temp\31207da839ead8fbe883e6ad7b6a816bab5928813878fcd184d6df4d9895b686.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
31KB

MD5
5342cf31f0031ee18fa3600428fd794f

SHA1
56155a6801989beb35eb15219e0d313293faba12

SHA256
2d1dd39b5d042a58ff522e2a9b8bab1416b9ef1c55d214e3c5aa706f8ae74894

SHA512
7e407244fddfb1602e8527064f2a26affd6d4cd2e7cf2726e2e886918a16fb87c7a82fcfd073725f919fed12bbcd50a7e2d7a2ccc57571b15ea6348e6bf21666

Download Submit
memory/3648-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3648-13-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3648-14-0x00000000025B0000-0x00000000029B0000-memory.dmp

Filesize
4.0MB

Download
memory/3648-27-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4364-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4364-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4364-3-0x0000000002820000-0x0000000002C20000-memory.dmp

Filesize
4.0MB

Download
memory/4364-12-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download