0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1d

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe
Size

26KB
MD5

549f226585b240bd06a09b547610ad20
SHA1

4ab4c90c45fcb4ae55346b21391544e0d34148a9
SHA256

0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1d
SHA512

42476111260cc3e80450627a73938e1c5993b4c7485d8052381af35596b4a296ea0520016f1407c489f16d0f0432077535b2c697d24e627aa27c7ec6e8585845
SSDEEP

384:Rgcx5SNj7YBqOETTITP5Dsl+AUeVn651h7iQroCuCE5NU6gZnRlGAcXq:T4j7YBkweh63h7iQroC8XtgZnRl2Xq

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe

Executes dropped EXE 1 IoCs

pid	Process
4020	storti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	storti.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4020	4844	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	83
PID 4844 wrote to memory of 4020	4844	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	83
PID 4844 wrote to memory of 4020	4844	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	83

C:\Users\Admin\AppData\Local\Temp\0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe
"C:\Users\Admin\AppData\Local\Temp\0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\storti.exe
  "C:\Users\Admin\AppData\Local\Temp\storti.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\storti.exe

Filesize
26KB

MD5
461e4e0ea9b9cbaa428b5daf98124926

SHA1
2d4e0124d105b44d9f402bad58146dc4c73283f4

SHA256
38ab46077fbf8251e8ace9acd7d966e9589302923ee3cc91e5d6cbf90b135f3f

SHA512
167c0516d83d8c6fe4d166bc0fbc8a3d3939f13e798322904f5872f586a8d84775d4372cc3303d7a1f6b02b74c14eb82f6fda3930ad13494322e1127905a2b17

Download Submit
memory/4844-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/4844-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download