630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6

Analysis

max time kernel
130s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe
Size 20KB
Sample241109-2txcpssrhz
SHA256 630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6
MD5 7dcfe0c342309893f4c40502138a0bc8
SHA1 80d85814b200ce36a116105afe33f46e0fec86e9
SHA512 cadd2fb77d76317e51b9d9de183f241709d2cc958eec278b1207c09285f939337eea6cc4ba3041573d238e3a31402d519c23f12ed9bb95e01b12a34b976c0020
SSDEEP 384:xiOQWRIga02iBunne0vq0/Cz9W5q586+JS:xVhRm0z+rC8hS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe

Executes dropped EXE 1 IoCs

pid	Process
4596	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4596	4940	630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe	85
PID 4940 wrote to memory of 4596	4940	630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe	85
PID 4940 wrote to memory of 4596	4940	630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe	85

C:\Users\Admin\AppData\Local\Temp\630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe
"C:\Users\Admin\AppData\Local\Temp\630d948a2d2cb27a93132bc31eddc00b8b9e8babb02e70d71866feeedab666b6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

389AE366D2070CE536197E55125E2F0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\389AE366D2070CE536197E55125E2F0E
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

389AE366D2070CE536197E55125E2F0E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\389AE366D2070CE536197E55125E2F0E
Size 420B
SHA256 59bf5e2fb3c8a4f1b8013a48c3c50e58ccd26f3393d9c24760362c3a87301db0
MD5 ef8eed0bcdb16598efa866d59fb956c6
SHA1 3e4f4406ca7c7feff4def376ed3490ffe10ef351
SHA512 71bf31629b266de8468bf516c4e1675034a82cfd9c7375ad10f07c00585dc51f0521a7a3d44ba7e81614e31bd21155cc5d46cb0c0a33fc6886ab74034cde24f9
MD5 SHA1 SHA512

Submit Download

budha.exe

Path C:\Users\Admin\AppData\Local\Temp\budha.exe
Size 21KB
SHA256 6ca67c9927b847900723ff5dff751bd90640aa2cfc04d45f379a9a1eb540352b
MD5 1c103289be18a1b63ffbf67754310f43
SHA1 efa80e2d211c93e77c0b865577e2a88f42da4c9d
SHA512 f1ea2f516743225c46aeb30415cf1636d55a35ae2df794b620285e21aec4fbf6a4564db0fd0ee9f1364034d990e2166a18cd1873fabe40e13c5d3f06f3e235c0
SSDEEP 384:xiOQWRIga02iBunne0vq0/Cz9W5q586+Jk:xVhRm0z+rC8hk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4940-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4940-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads