9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe
Size

35KB
MD5

792fa7deb16d920557aae8be16a94f33
SHA1

cab073907433739e4fb9188c452f9af2c4ec5c1c
SHA256

9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95
SHA512

864f7768f6fc8089e67182207b8ea56dab694f5ed03fe29f149aa9c08b17f93613d591e1205bcb6a190424335283e48e879da930d94deb30a61afcacc7ab14de
SSDEEP

768:qfRygBbJj0dRwzgvysfjEe4VmGTNptikR:qZTBFoRpqEEpVTNH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe

Executes dropped EXE 1 IoCs

pid	Process
1820	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1820	2500	9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe	83
PID 2500 wrote to memory of 1820	2500	9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe	83
PID 2500 wrote to memory of 1820	2500	9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe	83

C:\Users\Admin\AppData\Local\Temp\9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe
"C:\Users\Admin\AppData\Local\Temp\9681333def0df31418a194102d03c73e304d4276bca9398e7fd6c54b347e0d95.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
35KB

MD5
bf31a604de547488b89439530e6bc20e

SHA1
b7253eaa009d983746286f4a193e50429f680d0e

SHA256
2a81cc76c90509509927569b4c93d9f1e0eaa90977387e930f88f00572e55223

SHA512
9724683df3dd60af882946b8bdc78daa6ee01a296f43202ad4ed584d6dceaa0bc819f47b97ec79e87d52cd2957f4ba1e410afe0283d30f5851809a356f06d82d

Download Submit
memory/1820-14-0x0000000002040000-0x0000000002047000-memory.dmp

Filesize
28KB

Download
memory/1820-13-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1820-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1820-17-0x0000000002040000-0x0000000002047000-memory.dmp

Filesize
28KB

Download
memory/2500-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2500-3-0x0000000002050000-0x0000000002057000-memory.dmp

Filesize
28KB

Download
memory/2500-2-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2500-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download