7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe
Size

5KB
MD5

fb7ed7320154e5df1d918dc8c54b4ff1
SHA1

00ba2b48be2bf0207fb0e96e399824cbe256ee99
SHA256

7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb
SHA512

4a8facc8408aaa32db6028cdb317d4183c060ccba8566832712a4dc71ae48de760959849dc1c685d8f757ff9f41e8f05c14df866543552a16f4182e9f5e33004
SSDEEP

48:qao9qAmcRB/G98Bh3FaSmjce1rsHB/VnC/RAxUh2CS70ALNx:6rhLvXr+uHnnwR2Uh2ClAhx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe

Deletes itself 1 IoCs

pid	Process
4816	budha.exe

Executes dropped EXE 1 IoCs

pid	Process
4816	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4816	392	7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe	82
PID 392 wrote to memory of 4816	392	7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe	82
PID 392 wrote to memory of 4816	392	7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe	82

C:\Users\Admin\AppData\Local\Temp\7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe
"C:\Users\Admin\AppData\Local\Temp\7619c6dfb7257978d565e6366992b7251f4268e6c7e6cc63cea57b54e47abecb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
5KB

MD5
d68fc35b582d92225b5886960d417493

SHA1
8290fcdeb11630959ad70b01a9cae4df3ed1eb0d

SHA256
78193092b0c38bb8c07efcc256cbb31cd9a11928f6d1cbedb945a58df036eded

SHA512
dc7378d4231f4d5d9a338e547324186ba4f71fba34d477059c945aa6da9c2d1fe330080c3d84aef451b0c1fb84411eea7f703b191b33eac50104e43df82e64e2

Download Submit