784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9

Analysis

max time kernel
106s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe
Size

54KB
MD5

7e568f5c4c527ad0d26dd5ddc917eed0
SHA1

070f2898e2a4e4d440f92f38a71fe6e0c8df24a4
SHA256

784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9
SHA512

04550c9a9b1a6adb10d815485e82bc3136938224f41f5532e875feb9ba7c624e8eaddbdbe14b7ae81cbbb75131406f3942b9e6fc6d6e20353386f2a27bf80aac
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTJ:X6QFElP6n+gJBMOtEvwDpjBtExmlV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe

Executes dropped EXE 1 IoCs

pid	Process
1616	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1616	3056	784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe	82
PID 3056 wrote to memory of 1616	3056	784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe	82
PID 3056 wrote to memory of 1616	3056	784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe	82

C:\Users\Admin\AppData\Local\Temp\784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe
"C:\Users\Admin\AppData\Local\Temp\784752a9a288d6a1762b8931c29b31cabf2e2c45d78cc9630969dd345db061b9N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
54KB

MD5
deeaa96aab84aa9dc659830e5809fc6f

SHA1
8e51613e4574b602e0e0642cdf0bed4f5f8b3f33

SHA256
88b5ef4133aa5f3019aed37d35875c793d6dd2a7df00fe6c870e4a10d383ca0b

SHA512
d68547be2bad4dfa919751902fb62637c8d27a899ccaa095f3fea19c5d6b63f3cf879a692d04834d88d932b2c1ae8aea2ea90fc82510b4fe62036436dd21c08e

Download Submit
memory/1616-18-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/1616-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3056-2-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download