200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c

Analysis

max time kernel
126s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
Size

50KB
MD5

f44a0025b4f1e58b9f79d00ca9ec8bf0
SHA1

87fc848706b0fef1ecf2cca6a69167618fa60d61
SHA256

200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c
SHA512

3443d436d389968abddecc59b18af6db2e87d245734faa267df0c8f2a474c6447f09e2b9b7b3a526a89ece1ccdc57b7d783a6ce53b31f5dd4bc51751d98bb121
SSDEEP

768:hAvJ4LSyC8aVN7bX3V0S0AVrEXAgTlxorsf8ISy0:2B4OyC8aVN7jljBmpOrs83y0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	comhost.exe

Executes dropped EXE 1 IoCs

pid	Process
4432	comhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4432	208	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	90
PID 208 wrote to memory of 4432	208	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	90
PID 208 wrote to memory of 4432	208	200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe	90

C:\Users\Admin\AppData\Local\Temp\200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe
"C:\Users\Admin\AppData\Local\Temp\200beb929cd95dcef284c39e5690e4de1198c13d58fc9b116151d33bdc7aa16c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\comhost.exe
  "C:\Users\Admin\AppData\Local\Temp\comhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4192,i,5095735526234624271,6356691058050835509,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\comhost.exe

Filesize
50KB

MD5
6f39630a209a1520cc76e45d4afb3d40

SHA1
7223e445f05e89481e9d9fb0bc102b327a464d61

SHA256
ba8da7c644dbf2fca941365189d3f7e10abaaf9c1a7be71330f508e1b8aa93df

SHA512
fada9759f934dcca383be0e4895c189c1dc22b4caa0025d1bb05578b7a93c5d334ab138126cffc398140ed2f9c1455575efa28e15f279a7dbe122ee8db87d820

Download Submit
C:\Users\Admin\AppData\Local\Temp\rzmaw.exe

Filesize
18KB

MD5
82ed3dc33cd71025510a05b664eb558b

SHA1
fb1523ae7fa073a173afac08df9eaf3340fa962b

SHA256
f088b073091ffca7ca0063658e01021738be4665c4407ba475a8b9774e1b1ccb

SHA512
3edb2cde8d1477bec536361c9a931050b03348dd49284d443df34efb2fb62260cfaffe8a47fa20f05c7fde014b60be3ebeb2b533957ed215ba458655a81633a7

Download Submit
memory/208-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/4432-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download