3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
Size

40KB
MD5

0dd87583d62fca05908ee79115694763
SHA1

a1e1dc6c13c7ff4d58c3e37b76696ac2c54ebb98
SHA256

3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5
SHA512

c3db458c3a9f0e4295bae9616ecd32a64906290f51493e3c0057b235ddb7cddde1d0f15e73dfa8c04ac987406a384adc2a15a22acce72361ea2e0bb8f43e3cf9
SSDEEP

384:pAcTAjVwMatOwS58YwWdFeaeohweCvklV4Viq1cnD/kQzskH4qA1R4Jgl17:pZTAa/OZj74ybzPHzAtl5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe

Executes dropped EXE 1 IoCs

pid	Process
3184	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3184	1876	3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe	83
PID 1876 wrote to memory of 3184	1876	3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe	83
PID 1876 wrote to memory of 3184	1876	3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe	83

C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
"C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
40KB

MD5
3a6e7d98d3499e3850374f3a7812b8fd

SHA1
2a47bf03e9b9f8cea4615df5ea18d2f70b95fb86

SHA256
913f3c22c1063110f070e8a9cc032887559865f8af44308c965d0bb9f5665463

SHA512
3c63625de9c775c2a8214eaee1d8b9adf8c4924b70dd6934c8da04cc95058105d59948ff8df7dc6a19090aababac233e63b8e42c0b7223950c7e0b1d3ffa4d0f

Download Submit
memory/1876-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1876-3-0x0000000002050000-0x0000000002057000-memory.dmp

Filesize
28KB

Download
memory/1876-2-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1876-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3184-14-0x00000000007B0000-0x00000000007B7000-memory.dmp

Filesize
28KB

Download
memory/3184-13-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/3184-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3184-19-0x00000000007B0000-0x00000000007B7000-memory.dmp

Filesize
28KB

Download