acebc0766af1442f05e9319b6130098e438456bfa825e24e66f145ae357a2452

Analysis

max time kernel
112s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b61a30c3b887e92770d2a41ab3f7af0N.exe
Size

112KB
MD5

1b61a30c3b887e92770d2a41ab3f7af0
SHA1

1c68fe82754bfa707a6c118660e89140369d20fa
SHA256

acebc0766af1442f05e9319b6130098e438456bfa825e24e66f145ae357a2452
SHA512

470f9a6c782c38aba6d3401109e9040172f8c745f757691636539b8dfd3a1343dc15b0117ff7337a524effe8b2713893c1abcf1c16a4c0a7109263cf3f67050e
SSDEEP

3072:Wrv/pZIgQWGEkT9oe2lxBYNtdEI2MyzNORQtOflIwoHNM2XBFV7WB7lx7+srJ:Wrv/pZIgQWGEkT9oe2lxBUtdEI2MyzNE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	1b61a30c3b887e92770d2a41ab3f7af0N.exe

Executes dropped EXE 1 IoCs

pid	Process
1820	hromi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1820	1748	1b61a30c3b887e92770d2a41ab3f7af0N.exe	86
PID 1748 wrote to memory of 1820	1748	1b61a30c3b887e92770d2a41ab3f7af0N.exe	86
PID 1748 wrote to memory of 1820	1748	1b61a30c3b887e92770d2a41ab3f7af0N.exe	86

C:\Users\Admin\AppData\Local\Temp\1b61a30c3b887e92770d2a41ab3f7af0N.exe
"C:\Users\Admin\AppData\Local\Temp\1b61a30c3b887e92770d2a41ab3f7af0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hromi.exe

Filesize
112KB

MD5
fe5e3cb785e2a911ddf29da7ca01b644

SHA1
f782fa16b30313966b5ccda200134e39a1256ad7

SHA256
28c724b51f7c623f5b8fd0f8f3a972f38400f799a7d6924ee764dc648cb15d38

SHA512
f0336798b0cde3ef0173b468e14a2a61562b403c9a69731b478bcf317290ea8dc5b2788325a92ae2c6dad4e046174581d4a0835b91ed5538ec173b52e21ed522

Download Submit
memory/1748-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1748-1-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/1748-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/1748-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1820-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1820-27-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download