b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe
Size

52KB
MD5

366d5b4ce603795475cce84af77f4d60
SHA1

9b56829797f9bb1baccaad04500c06bf0b3986e5
SHA256

b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5
SHA512

8a493efdeae2d53907f3e0937601954ac7becd4d4f9b430f7e0104c9b8c309ea71c55c4470c2e59694e8919a004dfae889399c7a4897b97e4e42b3066b41478c
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccP6aDXlmfY:V6QFElP6n+gMQMOtEvwDpjyaLccCGXll

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe

Executes dropped EXE 1 IoCs

pid	Process
5088	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 5088	3124	b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe	89
PID 3124 wrote to memory of 5088	3124	b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe	89
PID 3124 wrote to memory of 5088	3124	b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe	89

C:\Users\Admin\AppData\Local\Temp\b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe
"C:\Users\Admin\AppData\Local\Temp\b9bf7b971be1ddbca5f4c5fffdde8b5b530c2475af3f5d368c3715150faf0ea5N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
6170fc66e961be4fda783a46522d13cf

SHA1
3f4829855b420566b15f83ab4d84622a3fcf862b

SHA256
f439c54d0b1cebbe7207e311ac3e9edf5935e4415d1658ad41a3ab90f276f7d3

SHA512
a14bf59645eb042b1681c0920b50f7cd889c968287d3cdeac5ad0c8c970dde7483da4248f92d73074873e83b421e12a45074da10750f5470c530026080c70b49

Download Submit
memory/3124-0-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3124-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3124-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/5088-17-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/5088-18-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download