b4bcf4153c3fa9e2171679b9df9a7e144df58cdf1b94a3e95a8d5a8c42df3fa0

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

578593dcf190211cd26b3e26563ae5a0N.exe
Size

49KB
MD5

578593dcf190211cd26b3e26563ae5a0
SHA1

249756ee09b14ba5999efb70b80f2c1ca05c80d7
SHA256

b4bcf4153c3fa9e2171679b9df9a7e144df58cdf1b94a3e95a8d5a8c42df3fa0
SHA512

66de27c2179f2f045a11713f217e2bf7c7172b70ffddfe1fd7109f495232f6278c17b90dc5532ff7f3fa56f6b96030dd98bc8a38a517f3e70722a0f814616a46
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu556BlvsTN:X6QFElP6n+gJQMOtEvwDpjB0GIWSlvIN

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	578593dcf190211cd26b3e26563ae5a0N.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1564	2952	578593dcf190211cd26b3e26563ae5a0N.exe	85
PID 2952 wrote to memory of 1564	2952	578593dcf190211cd26b3e26563ae5a0N.exe	85
PID 2952 wrote to memory of 1564	2952	578593dcf190211cd26b3e26563ae5a0N.exe	85

C:\Users\Admin\AppData\Local\Temp\578593dcf190211cd26b3e26563ae5a0N.exe
"C:\Users\Admin\AppData\Local\Temp\578593dcf190211cd26b3e26563ae5a0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
d8c25c964755d12257a38ea0402af435

SHA1
8ca576fcda19b0aee516835c706bef032dca4a8c

SHA256
4f5ceb22150c15c5042a41cc3113f8b6c961278d4354dfed1d12e23ede974a9e

SHA512
ec95d81a16bea2650365f3ac74bef0206bd50ff4074c0d37afe693d16a01b8290651971fabca23515fd3a8b334e2fe535302061e8553d3bc94d46e4324bfdeec

Download Submit
memory/1564-17-0x0000000001F70000-0x0000000001F76000-memory.dmp

Filesize
24KB

Download
memory/1564-23-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2952-0-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2952-1-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2952-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download