Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 10:10
Behavioral task
behavioral1
Sample
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe
Resource
win7-20240903-en
General
-
Target
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe
-
Size
92KB
-
MD5
9e70e5eac000ba74f5edfc4b05616680
-
SHA1
0fcc245847c61c1fec2e631407af42c1dc81b995
-
SHA256
516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20
-
SHA512
12278ccbf614250674151c7707e5a553a88cfcc0cbc62b9f18421b5d5f115d91bfa4721e10c48f796b8715678ca66d15acda94e7822eda8ebe36cb72aa77b66a
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpYk:AnBdOOtEvwDpj6zm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe -
Executes dropped EXE 1 IoCs
pid Process 4728 asih.exe -
resource yara_rule behavioral2/memory/1216-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/files/0x000d000000023b84-13.dat upx behavioral2/memory/1216-17-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/4728-25-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4728 1216 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 84 PID 1216 wrote to memory of 4728 1216 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 84 PID 1216 wrote to memory of 4728 1216 516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe"C:\Users\Admin\AppData\Local\Temp\516a230554fd6944f952ef94a42651d2751956899b233a3fa7fa6287a868de20N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD59d710a8292f37676d8ca4bb75fbccbdc
SHA1ba85f1c3c335a837b00825c1e019b0b12592a80e
SHA256b163fa1f3f986b15f53fcdd0dcdf9d5df6039dbc14669b544def316838e3e96e
SHA512a4b82529dd206e01e54701923ace19039e74a167ef5b9bce68e8254361e59d96555472383a5edfa0c3d3978ef265c8d445dc7bc846faa568621de844864d05b4