46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe
Size

80KB
MD5

07af6d71ae8f09589c3d2d60e61ea957
SHA1

eb0ecc42f191d3d4a374f5d5ba85dd2fd89cd336
SHA256

46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da
SHA512

5bb6e822c181f3d44e38bedfa922b930663c6af52f606b0adef6fbe7970970fa583937ba9512f233c00fa10ded0b5a537c5389dfd5c13a62265b03f616172f32
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOA+YSafiPuqds:T6a+rdOOtEvwDpjNc9

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe

Executes dropped EXE 1 IoCs

pid	Process
4392	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2156-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0006000000023288-13.dat	upx
behavioral2/memory/2156-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4392-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4392-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4392	2156	46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe	82
PID 2156 wrote to memory of 4392	2156	46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe	82
PID 2156 wrote to memory of 4392	2156	46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe	82

C:\Users\Admin\AppData\Local\Temp\46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe
"C:\Users\Admin\AppData\Local\Temp\46190ef02008489c45ab8d80a519c09ee4177dc4e1a18bf4a0582111ec9977da.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
80KB

MD5
5e6641b20b25f573f2b74b904903128a

SHA1
9e3084389a9dbd68e0ce264faa3b0aa4285e102d

SHA256
dca3a65e6a6d9539650bae15cefc6783bda6a98192ae7dfcf5d5f3e45f08a63d

SHA512
50961ae86e921468fbb2aad6d3800545e4d380b45ed8be63b0ab7d4ccc064b6647f8b021f8dee61dd88159b676e711e0cf954153605e3f8baef76ffbbef087ab

Download Submit
memory/2156-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2156-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2156-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2156-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2156-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4392-20-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/4392-26-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4392-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4392-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download