895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe
Size

23KB
MD5

c205f3805f746a0398e5801e38f8c941
SHA1

99be3c55080d12cc65c9ec493c667669cc5ab854
SHA256

895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e
SHA512

68aed5e3dadb254cabb07b16f2f05fd0bdc1af27478e8079b08cff0b9c2527987d72668ceed791f743ef7d8fc44449797767f5338ec4a2998d4ab4580f1c86cd
SSDEEP

384:9+Aaw4UDLXxQ08jOW/QNij53BVk46vfiPe68tR6HjTiLx4rwYRJ:wAabUxy2Ni1BG46vfiPUt4niyUYf

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/1220-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/memory/1220-1-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/files/0x000300000001e9b1-6.dat	UPX
behavioral2/memory/4836-10-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/memory/4836-12-0x0000000000400000-0x000000000040E000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe

Executes dropped EXE 1 IoCs

pid	Process
4836	zmvmo.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1220-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/1220-1-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x000300000001e9b1-6.dat	upx
behavioral2/memory/4836-10-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4836-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4836	1220	895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe	86
PID 1220 wrote to memory of 4836	1220	895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe	86
PID 1220 wrote to memory of 4836	1220	895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe	86

C:\Users\Admin\AppData\Local\Temp\895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe
"C:\Users\Admin\AppData\Local\Temp\895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\zmvmo.exe
  "C:\Users\Admin\AppData\Local\Temp\zmvmo.exe"
  2⤵
  - Executes dropped EXE
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zmvmo.exe

Filesize
24KB

MD5
dc82e79dcb2862a0ae3d8dbf8f42e55e

SHA1
bc8e1c46d542f4111b521a3bb1e560112afa8417

SHA256
e916364edeeb6541c15ead53caced9368ed081aba0e18e397456bb8b9bc9decf

SHA512
925996796bc365bbe6a8f31619da468c158ead58dd2726194adbb872804e7b93ff1c7aab0bc75a3b88b90d6eb3e3d33da552dc510e8c36d9cef98f59b640350e

Download Submit
memory/1220-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1220-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4836-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4836-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download