0b6f880b691939faf98d84d5f3032ae51efdd48cec5199da83c86450a94b05dc

Analysis

max time kernel
99s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d11917b0157d0174723eb202a737de0N.exe
Size

39KB
MD5

6d11917b0157d0174723eb202a737de0
SHA1

e1d3cd5032fd945b6f26a6a432d936703cc6ba14
SHA256

0b6f880b691939faf98d84d5f3032ae51efdd48cec5199da83c86450a94b05dc
SHA512

d8a207c46147952ebab9831ff178f7c0bbe95b5ee659cbbf5471554e026090eb1a352ace9d3d14841b1b381bdf2c9244405494fbdc4d87d914e5c22d8d1faa5f
SSDEEP

768:T4j7YBkweh63h7iQroC8XtgZnRl2zVBDj9sW3doLobv7ACCjwGeHhLueOsYUI:sj8vs63h7iQroCgtg4KQs7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	6d11917b0157d0174723eb202a737de0N.exe

Executes dropped EXE 1 IoCs

pid	Process
1004	storti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1004	2880	6d11917b0157d0174723eb202a737de0N.exe	85
PID 2880 wrote to memory of 1004	2880	6d11917b0157d0174723eb202a737de0N.exe	85
PID 2880 wrote to memory of 1004	2880	6d11917b0157d0174723eb202a737de0N.exe	85

C:\Users\Admin\AppData\Local\Temp\6d11917b0157d0174723eb202a737de0N.exe
"C:\Users\Admin\AppData\Local\Temp\6d11917b0157d0174723eb202a737de0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\storti.exe
  "C:\Users\Admin\AppData\Local\Temp\storti.exe"
  2⤵
  - Executes dropped EXE
  PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\storti.exe

Filesize
39KB

MD5
8f5cf726346fafe3cfd5f9ef67ee2bf3

SHA1
fa1ba79042865501ab0e1702658124f15abd20d4

SHA256
2d6d16852eec3e718642e9c0dc0cde1f554a45184869101b66b248f295cd1fc4

SHA512
bff6a81e800bcf58a8dc886bddea7a25f87fae776cfc28c4de92f6f84bc03c4200fbf2d55b2158b4b30a98dadbf478b1f1b39898c104112d148885e46f81f4d8

Download Submit
memory/2880-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2880-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download