9f4169c303014a19998441be1b8fb4317663d469fc890581ff27ba8f4a6d9579

Analysis

max time kernel
98s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d4efd982b9820a69c5343fc6827400N.exe
Size

56KB
MD5

41d4efd982b9820a69c5343fc6827400
SHA1

bafa0eca17a6280f7aaf095ab750e59e62353f77
SHA256

9f4169c303014a19998441be1b8fb4317663d469fc890581ff27ba8f4a6d9579
SHA512

59c8fef210c3aab0ff099ebc4f1fff43330d4efe39a9a57ba191d8a70b9e6d9627df2a67be8a9f651344733906b0f5b8356edee0ca84bafaa249bdb20640e987
SSDEEP

768:jxDDnyAiIbhn+oRTaFSxjquEDFAnA1tLRNk2djaYoCMHosOxECOsPNVg:jxDDnd1Raqq2uBNdSCMxCV1Vg

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	41d4efd982b9820a69c5343fc6827400N.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	hcbnaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41d4efd982b9820a69c5343fc6827400N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcbnaf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4672	4292	41d4efd982b9820a69c5343fc6827400N.exe	84
PID 4292 wrote to memory of 4672	4292	41d4efd982b9820a69c5343fc6827400N.exe	84
PID 4292 wrote to memory of 4672	4292	41d4efd982b9820a69c5343fc6827400N.exe	84

C:\Users\Admin\AppData\Local\Temp\41d4efd982b9820a69c5343fc6827400N.exe
"C:\Users\Admin\AppData\Local\Temp\41d4efd982b9820a69c5343fc6827400N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
  "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe

Filesize
56KB

MD5
ddfdae344bad999238ee5dad87f5346e

SHA1
97ca5a3cb77dfc14bc64c77d34cb223040885727

SHA256
7e24ee8590aab373764796ea606c1df17017ce561fbc78ff28f61a453415d17d

SHA512
1c271425936ede4f2f1ae25f5040103fee8d17cd8b0948c9d7301b73ec394cf0fda3e990ff6adb79ab0f9455218af63665c353f6448c21aedb1c23dc3ed5ea35

Download Submit
memory/4292-1-0x0000000002EC0000-0x0000000002EC4000-memory.dmp

Filesize
16KB

Download
memory/4672-9-0x0000000000580000-0x0000000000584000-memory.dmp

Filesize
16KB

Download