0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479

Analysis

max time kernel
111s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe
Size

27KB
MD5

026c8b5d3529983b86e02148414d46d0
SHA1

718767fa5ff2bf2e2222cb7828857cec650940a3
SHA256

0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479
SHA512

aab4f696c4f4242b7d191ec9e875c9518422d555d6cba4cf0af80985136eaecd9f700cc85a23b3b1f38736e0584ce23c04fa12319d2297f63c242709d048ca20
SSDEEP

384:F3EqGY2HXgrS40Lol5ZLzH4VhvshYpATUgch1A9NB/erxUkoF/o:F3EqG5H8PuoljH4vEhkgs1lxQFw

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4740	3516	0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe	86
PID 3516 wrote to memory of 4740	3516	0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe	86
PID 3516 wrote to memory of 4740	3516	0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe	86

C:\Users\Admin\AppData\Local\Temp\0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe
"C:\Users\Admin\AppData\Local\Temp\0abec8b423360a19870d213fa32b76387f64d7c0910e125326a2a46ae1dbd479N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\winupdate.exe
  "C:\Users\Admin\AppData\Local\Temp\winupdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winupdate.exe

Filesize
27KB

MD5
5be29658a402d0301c8b9efac4c9992e

SHA1
7ea753a298d9d7bbf11211af70125ca2c14a8167

SHA256
1c7bf32eac8cb25a937c6e41aebf6ebfac2378061a76578aac4d41e92c6643bc

SHA512
4d452a75037082266f9212734f511d7b7833b5e369becb95c58b0165fdcdf8c8d0f138d0baccb9fb60550f2110d4818141e6e2c9ee98748cbd5aa8cbe5859dcc

Download Submit
memory/3516-0-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download
memory/3516-1-0x000000000050D000-0x000000000050E000-memory.dmp

Filesize
4KB

Download
memory/3516-2-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download
memory/4740-12-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download
memory/4740-13-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download