01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe
Size 4.5MB
Sample240613-ry481ashna
SHA256 01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5
MD5 7cd5dcd8fadda623b3aa42fe9c0df079
SHA1 7e046aaaea622b3e2f32553fe0a10aebc9778795
SHA512 f2d5af075ee19de916cc746f79f0e90de40fa4571baafe5ea8a30bbf43361e00c015517cad4b9686e79a6f44a2d0a93d37bc7f2bf0402c12eb425d4981a85bba
SSDEEP 98304:csaB6aXff3rOPti2Q6D6cwc44u3T9VnFLOAkGkzdnEVomFHKnP:csaQmfCli2Ff4B3T9VnFLOyomFHKnP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe

Executes dropped EXE 1 IoCs

pid	Process
4604	up.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5016	01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe
5016	01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4604	5016	01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe	86
PID 5016 wrote to memory of 4604	5016	01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe	86
PID 4604 wrote to memory of 1664	4604	up.exe	87
PID 4604 wrote to memory of 1664	4604	up.exe	87

C:\Users\Admin\AppData\Local\Temp\01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe
"C:\Users\Admin\AppData\Local\Temp\01e2bd78292124fa0b3a8ce549e86a47608e3c708a55f3b8984c16067b2c27c5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\up.exe
  "C:\Users\Admin\AppData\Local\Temp\up.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c PAUSE
    3⤵
    PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

up.exe

Path C:\Users\Admin\AppData\Local\Temp\up.exe
Size 26KB
SHA256 cbc666fb6e6c8370bef47c2c7726eafb860ba0b2bec08def7ac835c95a8e62d6
MD5 c61501ba297dc9a60a5692ea8c487fe7
SHA1 7001152fe10dd10ad8c6b79b5658bc7837e3f0a7
SHA512 76be21514580865c730657bafc9014483048e4606bc42f7c3f98c7857a9459dbe4c8a7951149cf9699b585336801ee2a4c2169bc616f73ff46337a2e0b0f43a6
SSDEEP 384:d60wtXwwzwEYK7SjTyXmXE2I0uDi1hb//hXzaKEUKtYTw7u/w5rtYtwJvDF2Peh7:Q7UDBDEU8YLYht6wJv7A27c+xG
MD5 SHA1 SHA512 SSDEEP

Submit Download