5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992

Analysis

max time kernel
9s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe
Size

72KB
MD5

31b553182fb249e1b1b98c0f7cdcc8d4
SHA1

1e2a33857c05916ee71d583313cd8a7713f67aee
SHA256

5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992
SHA512

47dc08f49ad1fdab47ccace9e05ad03a285c65915b5ebf413e6fc4a337cbd4a9129f8fc9311e56e333f78c971f305c50b54cebc11edd3c9aa7efc01a1433b745
SSDEEP

768:SaQRYAAjW593LabCD/6/Xl2E/Ctt4WSrAK/G:SlPACze2JSMYG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe

Executes dropped EXE 1 IoCs

pid	Process
1892	sioyo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1712	5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe
1892	sioyo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1892	1712	5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe	92
PID 1712 wrote to memory of 1892	1712	5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe	92
PID 1712 wrote to memory of 1892	1712	5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe	92

C:\Users\Admin\AppData\Local\Temp\5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe
"C:\Users\Admin\AppData\Local\Temp\5bacfcafe3504acfab80b9e675e79c903ad3db6f3d4a86347554b563e7e94992.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\sioyo.exe
  "C:\Users\Admin\sioyo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sioyo.exe

Filesize
72KB

MD5
3ac3b20edc2f73ad0f36e52418a9950e

SHA1
77070fb2a6a53f7e01348acd26826b8f13b09769

SHA256
19ba2ad5e2207b8c9b5561cafcdeed94d33def7fa1302c7720d662a0baea66ee

SHA512
7b7ccb93cf15fe02b5b92fead88517521ca46df44939d09c1a748adc6debc897aa9085b6e45b49a582c289b7d08393595c8505169caeb8fee8820f4cc7409212

Download Submit