61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36

Analysis

max time kernel
106s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe
Size

42KB
MD5

52c9a0229c3cc5db99998b34f43d9e50
SHA1

8fcf5b2b4a87975b7b870125ee9a4cb00c00e9b0
SHA256

61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36
SHA512

885c31e9b0487a655f12810ce9554031a3cb1693446819de605b3862af844bb431ba73ef515c924b2cf7405bcf663eb0277fff485f93b558c16c2d4e53ad3974
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaHaMMm2X3R:V6QFElP6n+gMQMOtEvwDpjyaHaX3

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe

Executes dropped EXE 1 IoCs

pid	Process
4888	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4888	624	61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe	82
PID 624 wrote to memory of 4888	624	61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe	82
PID 624 wrote to memory of 4888	624	61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe	82

C:\Users\Admin\AppData\Local\Temp\61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe
"C:\Users\Admin\AppData\Local\Temp\61a9952d6566f8aafa86b98d76610ba5e8b8c6ed71558e311d47c173c15a4b36N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
d7df5d1f25b09ed49cb40cedc854aeb4

SHA1
145733adf69d6cdb7e9a3a7cfd204ff4c9dae92c

SHA256
540de2bb3041f9767afd85c5ba086c96b05e21e7f8199ad6c58ca409378ae76f

SHA512
ee139266414449a3b314f2b83ebebc590731d01e58d24f1bf3126a44f96546cc3f4a1d5cc433aa4c4c43112e23d7ed22fd1374b2473539e69bb8f637a7069c97

Download Submit
memory/624-0-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/624-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/624-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4888-17-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/4888-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download