8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d

Analysis

max time kernel
91s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe
Size

154KB
MD5

0aae3d12c5866fb90e7841f3b64c1bfb
SHA1

f8f472d74b5c6ca4515630dc268d31f5ed0fc052
SHA256

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d
SHA512

794fc048cbe0fe2f2565706bd33fed1a4c9f93a91833c32eb77bdf912435a50c8d9c3f0aad4c4c8a0e635a7731bc9a9b7da056c1aefcfd63cbed3719e4ec42fb
SSDEEP

3072:Ntbqvi9nMKxQbZ5x66EfACsxfcYvQd2Oeu:Nt2vsx+AV4LfLOl

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid process

4336 biudfw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4336	biudfw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe

description	pid	process	target process
PID 1004 wrote to memory of 4336	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 1004 wrote to memory of 4336	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 1004 wrote to memory of 4336	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	biudfw.exe
PID 1004 wrote to memory of 2364	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe
PID 1004 wrote to memory of 2364	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe
PID 1004 wrote to memory of 2364	1004	8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe
"C:\Users\Admin\AppData\Local\Temp\8483ee06aef2a6c8fc449d815a8d0d6923b31a5eee1a2ee166fa05e3982f734d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
2⤵
- Executes dropped EXE
PID:4336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
2⤵
PID:2364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe
Filesize
154KB

MD5
a5452e799f259f9ae13f4ddced5f77d4

SHA1
1939e7b25db876183715b391f89ec516840e499e

SHA256
d8de8834f7e0a67b33eded88cc49a7762ad5cc39421f863d7c5f14fd96bfaa0c

SHA512
fe1e4fd6175ab86c006893e031a1cecb0f917594995a1f0e9c4cb5a114660c268753ca0cc12a734e9d7a8ec6d5597d4307aee212942ebe9ba4519a12193b2c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
512B

MD5
2930c042c9ee5e07f321f2134a0c7edc

SHA1
ee39f41eaf6ce3c8d917a89e65959414ae0088e6

SHA256
a328475bbb730da292b83ed6cabbdbfc0616f042296f0c6fa356c5368ffc1309

SHA512
2da91d5effc116d8c8661c2a99f1d9c2aaffda0f776551dc7ad1911fdb2765591e5b441b9a1fe0090bcda8ed24d180b563ed2c127676cf1de40001e4b15b5506

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Filesize
338B

MD5
1da09de2f3d27b08d838d54386f25ea6

SHA1
32f77dc23c21d2e657c6d088272bfd75676e411a

SHA256
c68ac859fb556f76a4b0ff68b3c5251f993acc99b38a847f369d62a3e42f640a

SHA512
51a8bc35d63a39f101649d9e531fd749bde3aceb501364d0f9cbc8cdb013452f1d5fc6343bd26ab8cd76e9f4016de7be7ffce3ba374692597f61781b395d3e28

Download Submit