754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe
Size

5KB
MD5

8c6b9c50810df50175ab8419edcd94e1
SHA1

6f0235aa122b0f44f9ce2efa33bee050d833edaa
SHA256

754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d
SHA512

4e5f2a93bc4a0fa7dd81f5ab5e1546768196c6268dbbaa031f7fd7768740cca0b7de53414e6a413be200f3c60a3e2f0b678f18b7df63b06935953a796bb0c35d
SSDEEP

48:qvECf6Am8RB/G9SU3NnZ1rsHB/VnC/RAxUl2CS70ALNx:nCTxLgNnZuHnnwR2Ul2ClAhx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe

Deletes itself 1 IoCs

pid	Process
4372	lasma.exe

Executes dropped EXE 1 IoCs

pid	Process
4372	lasma.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4372	1144	754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe	83
PID 1144 wrote to memory of 4372	1144	754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe	83
PID 1144 wrote to memory of 4372	1144	754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe	83

C:\Users\Admin\AppData\Local\Temp\754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe
"C:\Users\Admin\AppData\Local\Temp\754ba038b983abbd6b7f9de8986b9da0fd904f08ea841403657e1509ebf5bb4d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\lasma.exe
  "C:\Users\Admin\AppData\Local\Temp\lasma.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lasma.exe

Filesize
5KB

MD5
eb8b19ef0ef0b806437ff919b06b8fc9

SHA1
8d30e9e968dca2b2795bee25607a5057dae28fc1

SHA256
c1f1b18e5fed9d0b521426bec474518dfbf09fb18c413c6164ebb6fadb911f77

SHA512
7aa0c0d8d89a47b445327899d05510a0e256dd86c4426c408e23d85ca1184c5a494e8c8ed0ce5eed1dde35b93684535fa34e7096c52c711f0bc2744f030c4165

Download Submit
memory/1144-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download