Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06-06-2024 04:03
General
-
Target
eb2d35fd358413e22ca973db4debc883.exe
-
Size
61KB
-
MD5
eb2d35fd358413e22ca973db4debc883
-
SHA1
84b3bbc848447ab5ded987789fa3ac6ca884c9aa
-
SHA256
4539450a1c36d97e020a37ee88c7bbf79b9c3a80e8836d70ddb6fae046cce5e3
-
SHA512
ac1f3fecc42a2635d8cf515921027aa805d4b5d4ff611fa383074dff845a765da24921ed8cc76869132133976fa17987fe6ab5cc44e7a8b35e53709623216035
-
SSDEEP
768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP6pU0:H6QFElP6n+gou9cvMOtEvwDpjCpVXp
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb2d35fd358413e22ca973db4debc883.exe"C:\Users\Admin\AppData\Local\Temp\eb2d35fd358413e22ca973db4debc883.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5aa21aad3bc789a2ae8e9e9372133ddfc
SHA1e0de8edf078ef27ace7378ee8a2af543037ab204
SHA256f1a211762fa1d016c9519ed1b2a0677577dc1767f1e46de1b684492d7fe4b8f4
SHA51234be13c3692d380044b4ecf9cdf2157290e2036aa0b03971b2b8525c8fbd83e80b18a8acbe0f8e0920ecba2d82996af9a44087a7de312132eff2a50ed34e24ff
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB