d4bb9eb9bdedfa37f8b43e73c197bc12830239404de20ca6701c1460682bc283

Analysis

max time kernel
111s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a628bc395e14e2d45b059cd7452f8900N.exe
Size

34KB
MD5

a628bc395e14e2d45b059cd7452f8900
SHA1

106dfa95f1405ef0f080943e0751887aea1009ed
SHA256

d4bb9eb9bdedfa37f8b43e73c197bc12830239404de20ca6701c1460682bc283
SHA512

1f1fc3e3e34e53f08109272fff5d15ad328a17e21843b949cd61adef4091cc791ca9510c4021e178452a79d8c056656e990f6d0feb7947b4c5d6308871add1dc
SSDEEP

768:nQv/YOZIgQtz8GEkT9oe2lxUCuY9m9e9tdEI2MyzNORQtOflIwoHNM2XBFV7WB7Y:Qv/pZIgQtz8GEkT9oe2lxUCHCetdEI2f

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	a628bc395e14e2d45b059cd7452f8900N.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	hromi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a628bc395e14e2d45b059cd7452f8900N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hromi.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2244	3868	a628bc395e14e2d45b059cd7452f8900N.exe	86
PID 3868 wrote to memory of 2244	3868	a628bc395e14e2d45b059cd7452f8900N.exe	86
PID 3868 wrote to memory of 2244	3868	a628bc395e14e2d45b059cd7452f8900N.exe	86

C:\Users\Admin\AppData\Local\Temp\a628bc395e14e2d45b059cd7452f8900N.exe
"C:\Users\Admin\AppData\Local\Temp\a628bc395e14e2d45b059cd7452f8900N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\hromi.exe
  "C:\Users\Admin\AppData\Local\Temp\hromi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hromi.exe

Filesize
34KB

MD5
38b54ba5052edf3c52fa8cc9eb796605

SHA1
e7595ed9d9708b9dfc5cf9f2917c18493b3cbf7e

SHA256
bd3e7fbec78a2c6e8261b456bb1cbc27c93a22f64fe0758ded3de63f12574b9e

SHA512
59075ced8f31788bbb47b495b77c8e2195ad185ade98583738e3e0f0b97ad1f6a3ee9174b585d46c6886c61c5e3fdb79d25fb38b47a9468d4b2370452d58d2b3

Download Submit
memory/2244-20-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/3868-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3868-1-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/3868-2-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/3868-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download