2519437328b97d1c8d41852c359f60f8dbee1888f648543616e95eaa1cd7cb99

Analysis

max time kernel
122s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe
Size

44KB
MD5

eaaa406950ff1a3f95b4974c9fe00b00
SHA1

c79e5c571a0f5966263217a0ed22c66d4e2e8c5b
SHA256

b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476
SHA512

109a5361ad926c8c36f8651ac520b6288f83a3f73e8c59a2767e61192e5ac533b1bbf133f441e30f19b46a2a9fe286e3e36ffec7d6183ee629be7eede68af975
SSDEEP

768:/VhR61d2hyKIDMi5FazjmilAA8/wv3pclKWhtWS:jed2ZFX/8/wCaS

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2088	5000	b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe	84
PID 5000 wrote to memory of 2088	5000	b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe	84
PID 5000 wrote to memory of 2088	5000	b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe	84

C:\Users\Admin\AppData\Local\Temp\b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe
"C:\Users\Admin\AppData\Local\Temp\b09c5e70253a1cb5a81643f15f311dd2a5f772c92d662304170372013865a476.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
44KB

MD5
7a7d1db05c15ac725922d4d1ae1a3463

SHA1
328bc6d76df4c9b32d0c3d366c5c4258cd22344c

SHA256
d75968afec3bab042c30ff1d759a5bc905dddebf8526014a2fef19c4f0b5ec39

SHA512
599a7987ac91a0900e1ef67a84e4263a351250a3365eeea0afd73eb1db55b69c18759f0a1003078abad17aace52974624142f3cdbc4bef0bc22cf44acc22e36d

Download Submit