603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe
Size

35KB
MD5

b3e147cf35094694add7e44225c4bd6a
SHA1

0c6de416526b4e8abf560e09c00243e75eb0e9cc
SHA256

603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009
SHA512

ed9e78862fa6c38e10a799e9d444850f721287f34c39d543458a5bf13906e48f2bce09c61a74fec572df23c0bee3fd4492b4c3a8c14d20cf01daa68d18a69c04
SSDEEP

768:cy5dA+DX/8KH13vfdHldhwyEgYzQw2TSuL:bdA+oi13vfdHldhwgp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe

Executes dropped EXE 1 IoCs

pid	Process
4828	kdeohw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4828	3596	603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe	85
PID 3596 wrote to memory of 4828	3596	603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe	85
PID 3596 wrote to memory of 4828	3596	603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe	85

C:\Users\Admin\AppData\Local\Temp\603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe
"C:\Users\Admin\AppData\Local\Temp\603f8e8afb55c4b917237c77af06defe444c77160798668fe6305c8673f17009.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\kdeohw.exe
  "C:\Users\Admin\AppData\Local\Temp\kdeohw.exe"
  2⤵
  - Executes dropped EXE
  PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kdeohw.exe

Filesize
36KB

MD5
d809da71ac511913723a7078c6f7042f

SHA1
1863d5f3bd2a733f80f6a652d9cd92b4000bd1d0

SHA256
84a3902f477bfaf0c268628753ea33fc0f424271b98599cf3670be16a247ccc6

SHA512
38c2759519830fc7f018aa595f97bc7d9b01d9ae65a15f10dde4d271fbe54aafc9d2a5b187b5ef648e513d5adb9c36381ccba2b91a93f62a98b673e751e7148b

Download Submit
memory/3596-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3596-1-0x0000000000570000-0x0000000000579000-memory.dmp

Filesize
36KB

Download
memory/3596-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4828-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4828-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4828-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4828-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download