78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe
Size

56KB
MD5

31acb2b22428f8c37a2f00032fd96d2e
SHA1

835e65130270f30aa54fa8203f8498bb2d258b16
SHA256

78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03
SHA512

303d151f69a792c908c7a9b0937fc0b7b4385d2407dd8260a77eb483287af3a446c640a5218125df1b664b5880eaef54ca2d598965763ec27cc678295f39c421
SSDEEP

1536:35H5545555555555555555555Au5555555555555555Fq555555555555555555e:/+jUQQQtX

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe

Executes dropped EXE 1 IoCs

pid	Process
2124	nmiya.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2124	316	78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe	88
PID 316 wrote to memory of 2124	316	78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe	88
PID 316 wrote to memory of 2124	316	78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe	88

C:\Users\Admin\AppData\Local\Temp\78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe
"C:\Users\Admin\AppData\Local\Temp\78736af2c57e85f8a510ae672db4e85aff207981e1da90591793ecccc61f7f03.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\nmiya.exe
  "C:\Users\Admin\AppData\Local\Temp\nmiya.exe"
  2⤵
  - Executes dropped EXE
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nmiya.exe

Filesize
56KB

MD5
0255b557de6024d4154aad7f247f6501

SHA1
59e15cb4156736bd73a2e4c9567f7de6dda46fab

SHA256
57523fdeae891eade85efa4d9fb53a10c009c7b20d403d7625c82000e5b7944f

SHA512
0b8743caa4c59cfd0d702ac45f250d74d76ddaac8edb3651cd2ffb6d97967c785d987f5abf8b9ae1a2c46410dc879301b05dd59b8493effbc78fcfc846612524

Download Submit
memory/316-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/316-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2124-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download