6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe
Size

1.5MB
MD5

b6665390cce41606cb845ba11c2b24b3
SHA1

b56e581a321d0b7102c9ea1b83486e9ab7f7e5cd
SHA256

6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5
SHA512

ce1a6070ce10de7ccbd167897d4d19766c8db96adde38f6cbbd6c9b5ef4db9c7c94c89cf0239547f9a70f12d04158b9417a152c4c28d07288ae84b6dc7a0c229
SSDEEP

24576:5OtT5xvEeiNboeFyZuY588lZJxip12/V01imQxlqbyDPr3eDj+g9dEnNeTi/v1iZ:5OtT/i1YxlAXMV0sJ70ywENeTCiQ0dd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe

Executes dropped EXE 1 IoCs

pid	Process
4832	aConvTabV2m1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4832	2948	6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe	82
PID 2948 wrote to memory of 4832	2948	6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe	82
PID 2948 wrote to memory of 4832	2948	6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe	82

C:\Users\Admin\AppData\Local\Temp\6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe
"C:\Users\Admin\AppData\Local\Temp\6a376fe44ef36163cd1122115de56b53257515f8cee61ac80d808e41cb5b58c5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.EXE
  "C:\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.EXE"
  2⤵
  - Executes dropped EXE
  PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Delta5\Formularios\F2217v03\Otros\aConvTabV2m1.exe

Filesize
270KB

MD5
27e47bb149d4415dba28761428703403

SHA1
7387016cccb970d947a9c1da94280147d6fcda2f

SHA256
6f7f09f1588b05c2598eb86ab0a789a1137a9c069b3db59db377a4a8ee36fd63

SHA512
9032bd671690ae5ec552303c531c2b31b90eae64ac6b50414095b9f4502641633c558b30dc2c10c591fed906250e792b0d13f00681fa3b60f667805e6a51b7ef

Download Submit