12c8a9ab93649f8c75399b6b96f4c54e7454cd0eaa25090dc53c223788c85222

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AimmyLauncher.exe
Size

161KB
MD5

1b61edaed8b5543cd875d3d22a219947
SHA1

45d0ded1b50b37063f3a0f328d56f676ccb0e519
SHA256

f9b275cef715b35cd5357b881bf2e62a22a6ea01a46f917cd2c072cdd2b3a18c
SHA512

668b3ee30fa7b2dd4a8e368f8b8eaae387f0641b2f874984e398a11141f520102568520f4fe27b6cd370b0b927f809073f9080092a413086e6f37a06de785a7b
SSDEEP

3072:BKta93TRDiicws0MWbs2OJiKF/ODxT5CyV9u2jNI8m5:B2wX7bJ39uyNJI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	AimmyLauncher.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	zdFeqqsg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	zdFeqqsg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2168	zdFeqqsg.exe
2168	zdFeqqsg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2168	4388	AimmyLauncher.exe	85
PID 4388 wrote to memory of 2168	4388	AimmyLauncher.exe	85

C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\zdFeqqsg.exe
  "C:\Users\Admin\AppData\Local\Temp\zdFeqqsg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zdFeqqsg.exe

Filesize
139KB

MD5
32d886bac9144bf9fb583795159f22d6

SHA1
dfc1e1ca5bcf103b216c2b109fc7148659e10b3d

SHA256
2a40fce818ecb5c50a521fff6d0538382084c71c65e0d8025950a239187995f3

SHA512
f4d2e5bf7bc46c9796f241fa8127d23686bee8c9761519da9871f2d2f7fd38e3a32fcbd16a1063b56f5c80d033567279cb97cc7aa66911f98e6561125eb50df4

Download Submit
memory/2168-13-0x0000017FFFFC0000-0x0000017FFFFC1000-memory.dmp

Filesize
4KB

Download
memory/2168-15-0x0000017FFFFC0000-0x0000017FFFFC1000-memory.dmp

Filesize
4KB

Download
memory/2168-14-0x0000017FFFFC0000-0x0000017FFFFC1000-memory.dmp

Filesize
4KB

Download