c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe
Size

31KB
MD5

c36982cc0b5b65c354f7deb78cc4c3af
SHA1

534f30afe3a823cfccb34b43c36ee60d6e8e47a5
SHA256

c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981
SHA512

bc0f0368583f4d69ad48e0454e3f9ccf0bc933add57e0e17e1a625517f154459cf9fa0e6b75ee2f7e82fbe496878dd3dcd457647d56f7136b916221f618c9631
SSDEEP

384:ctz3+pmuMgm4PHgTfhl1IBxRlHzZN2zVqObfVbynZcH:6zQMQWlqBxRlHzZN2zAaVbRH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	laccm.exe

Executes dropped EXE 1 IoCs

pid	Process
4748	laccm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laccm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4748	5008	c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe	84
PID 5008 wrote to memory of 4748	5008	c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe	84
PID 5008 wrote to memory of 4748	5008	c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe	84

C:\Users\Admin\AppData\Local\Temp\c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe
"C:\Users\Admin\AppData\Local\Temp\c844c2e53fa779f0c14203762fb4001402eb635e9b9db94dac444eb632bcb981.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\laccm.exe
  "C:\Users\Admin\AppData\Local\Temp\laccm.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\grias.exe

Filesize
58KB

MD5
908b99693d82a7bba63e80afc00e2a14

SHA1
c918cb3179462809003aa658a1a7630307a692c3

SHA256
41c0da46f59914a5423c8a2631b6b4290dcc2e61d576beb98dc9db76555a3509

SHA512
1ea2b8306574bb217e83411d11efeb77a15949539d5d2129434866d864bfbed4e44fa2fc4d367aced9404ab504934899d3431c20a8e5a12f5afba44d3a2afcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\laccm.exe

Filesize
31KB

MD5
ff0bc97f9b443bfe352468023dde926a

SHA1
9669c875398c145bbc61dd6c2dd97722578c13c5

SHA256
c9d2e129707b39d8974655eccf6f729039c474c751e62cf2109acc4bd73a3316

SHA512
4310d02f5889091a22726d519441fef7f2a7e5f724ca2d4eeed6237c5b5918b9ed3fde0bffa6d6946e45a9c254d869b2b47d7709e3068ebb0f6878811bf291cf

Download Submit
memory/4748-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5008-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5008-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/5008-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download