16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe
Size

57KB
MD5

56080e25438a85d7240fc2ee1db5105c
SHA1

17ac3da26bed29f8f7f430f9c7b8c32376bf01d7
SHA256

16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f
SHA512

83efb51a0f04fadfb0323d3e6c57eb0e1a3fdea232fcb2f26f8e9a10217a4dd92637c27364d7e4a48a077e1213d552e748460528eca537855c0e694d9c2352d4
SSDEEP

768:zTAiYUVaQDKVRRZgqq6UFFAKcls0ceVA1JYN2BDMSdzlQcjw:HAqamKVO6s0hVA1JH1MSdJQcjw

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	fcbnaf.exe

Executes dropped EXE 1 IoCs

pid	Process
4840	fcbnaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4840	1268	16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe	84
PID 1268 wrote to memory of 4840	1268	16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe	84
PID 1268 wrote to memory of 4840	1268	16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe	84

C:\Users\Admin\AppData\Local\Temp\16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe
"C:\Users\Admin\AppData\Local\Temp\16fe49982591614d9958d588826680eb10c9f49fd3a6ab314a01f0ea07cc7f5f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fcbnaf.exe

Filesize
57KB

MD5
9f246280444222b8ecd425997a9dc613

SHA1
75089be8983782c57d30ec1a93d0af80ff0019c2

SHA256
1818934e384adc14c5dcb04e0acfb52be759ece6c10c2c00bfb906042803e9bd

SHA512
def374142633a3ddaceda585f060d98e64d2e47954ab84222b609cb79bb77d1a120a0dda5562da2f6b09263ed6cf18754ab7187dadf263584904078451b4ece5

Download Submit
memory/1268-1-0x00000000003F0000-0x00000000003F5000-memory.dmp

Filesize
20KB

Download
memory/4840-9-0x0000000000370000-0x0000000000375000-memory.dmp

Filesize
20KB

Download