b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe
Size

54KB
MD5

6f29b258474549aa8209af41d3b2ad0a
SHA1

52a271d3162943596f8ef32eabea280333c1a2df
SHA256

b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45
SHA512

20c066d27f6c5bbb11faf6eedab3a2fe15c2192fbf785f87c6acbb592db014742965a3098b255bad5f41ed1733705ced76e8bd1f62a20746fae1bd23a0a472e9
SSDEEP

768:MApQr0ovdFJI34eGxusOy9Rp1pLeAxoeC48PqK1OtaP6cCFzENREMZ7yW:MAaDJlMsh7pWezEPJB+Ox

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	sal.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2456	1372	b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe	82
PID 1372 wrote to memory of 2456	1372	b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe	82
PID 1372 wrote to memory of 2456	1372	b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe	82

C:\Users\Admin\AppData\Local\Temp\b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe
"C:\Users\Admin\AppData\Local\Temp\b8155875b74726ea01749d96603def4de50255368e9988168ff54cda95e6ce45.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1372
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sal.exe

Filesize
54KB

MD5
855a65cb8a5a69617ef86362a2168d7f

SHA1
a6c1f2277cac64b5059b4e2b41fb24fdd7b053c4

SHA256
66c1e7ead2988505e8484007f0d7647cb075144a53715a0a7755a73c23bc2a44

SHA512
4dbb0dc02e0b7c3f7a77bd1c52b1ae6bb2c0002f9fad87e4c49a5803d5042534d1f90f94e2a5e57dc1223ec71c6b4909c62626e5438ba0e976158a17de01e4ff

Download Submit
memory/1372-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1372-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2456-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download