4f6342ec8d2984dcbfcebf8019cdf3f65e5439d88f33987bb93f65275028ae5d

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63cbd3e702dae6cc5d48a6a65823ff60N.exe
Size

34KB
MD5

63cbd3e702dae6cc5d48a6a65823ff60
SHA1

29da6b5d42a4fcf43e3559e1a549836a86beb806
SHA256

4f6342ec8d2984dcbfcebf8019cdf3f65e5439d88f33987bb93f65275028ae5d
SHA512

677df65d02be23989f596695694c2cc28a6fe51256082a2435f01355d66830a1703bbaa67e6d61996c04bbfa0665406708171cde61bb97079700ff7648d82dd7
SSDEEP

384:tGx04wzHycMnzWHr5r9Vc5lxr8gPkijToDeYBWX2SENkNSflyzDWeQ3jji3:UxHc0Im/8m9TMe+WGFUSflyWA

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	63cbd3e702dae6cc5d48a6a65823ff60N.exe

Executes dropped EXE 1 IoCs

pid	Process
208	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 208	4212	63cbd3e702dae6cc5d48a6a65823ff60N.exe	84
PID 4212 wrote to memory of 208	4212	63cbd3e702dae6cc5d48a6a65823ff60N.exe	84
PID 4212 wrote to memory of 208	4212	63cbd3e702dae6cc5d48a6a65823ff60N.exe	84

C:\Users\Admin\AppData\Local\Temp\63cbd3e702dae6cc5d48a6a65823ff60N.exe
"C:\Users\Admin\AppData\Local\Temp\63cbd3e702dae6cc5d48a6a65823ff60N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
34KB

MD5
7c055be57a32214a7ab179bbdd30f3c1

SHA1
f8600cc3a4d46c3019937b655d12397ae6ee0235

SHA256
4516fd86e2e7ba315b8a601fe4483e97d705f63794115f4ddb260e6702818519

SHA512
31fe0fec235e5d4ffd6cd91afeb0a5368cfd79ab8354ce3428ec77f6825e2df486f2a0392d681bdf46f5fad6aa289eee3f67c0d23b1f3525dc22f830bced2eae

Download Submit
memory/208-14-0x0000000002580000-0x0000000002980000-memory.dmp

Filesize
4.0MB

Download
memory/208-13-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/208-15-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4212-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4212-1-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4212-3-0x0000000002780000-0x0000000002B80000-memory.dmp

Filesize
4.0MB

Download
memory/4212-12-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download