c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260

Analysis

max time kernel
151s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe
Size

23KB
MD5

f1e10f43694737791ea18d047360d0f7
SHA1

d8c4cdedd1c50cb0f1ff4854b364be8e0e793c16
SHA256

c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260
SHA512

49c9073412a3ad59ef35b06e8290e0b3ef85e45c2337ccf34b613550a589115ea9b51a935f2d428590597d9e6c97157f19098035ff36771d19c477df106752a2
SSDEEP

384:pkoDpm0q/1PPZW2I8LmRj31fBeRYIzLV4:BDpDq5PZW1cGjaRYI/V4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe

Executes dropped EXE 1 IoCs

pid	Process
4488	liena.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4488	3264	c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe	91
PID 3264 wrote to memory of 4488	3264	c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe	91
PID 3264 wrote to memory of 4488	3264	c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe	91

C:\Users\Admin\AppData\Local\Temp\c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe
"C:\Users\Admin\AppData\Local\Temp\c262ab63d9a3f71df124b1f5abd20bd2e61d6e7eff6697a650d5e3e476cc8260.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\liena.exe
  "C:\Users\Admin\AppData\Local\Temp\liena.exe"
  2⤵
  - Executes dropped EXE
  PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\liena.exe

Filesize
23KB

MD5
e8440a869f13b70fa6dab7faf7d17e47

SHA1
cab6026c5341cc654dcce236022afaba61f2613a

SHA256
8f0375e3d6b31180640cd794cee93336c2dcd16be470be12fb201cd4771a6ced

SHA512
1d7b3488d035f99644ec0a5c5b543acac98df00429ecb2ce9709de0611608be2ca806de2a10a14c3ff57fcfcd31fe0517a94c28a35f25f3c57954d29660828f9

Download Submit
memory/3264-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4488-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download