Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:21
Behavioral task
behavioral1
Sample
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe
Resource
win7-20240729-en
General
-
Target
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe
-
Size
38KB
-
MD5
3f0a54bc9f220bc9c8bbd7fc7f584154
-
SHA1
b82a32eff58844b74e0f6028ad679d4d7c0c831a
-
SHA256
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18
-
SHA512
8b854eac67aecd10ef6044b79dc64daff2afe1a776d1d093fccb349ce269e88462c7cd0c55de0251084c5248b25253394630851b7af6fb69d83b4b776168ae4f
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITElz:qDdFJy3QMOtEvwDpjjWMl7TE5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 628 asih.exe -
Processes:
resource yara_rule behavioral2/memory/3200-0-0x0000000000500000-0x0000000000510000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\asih.exe upx behavioral2/memory/3200-18-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/628-27-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exeasih.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exedescription pid process target process PID 3200 wrote to memory of 628 3200 a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe asih.exe PID 3200 wrote to memory of 628 3200 a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe asih.exe PID 3200 wrote to memory of 628 3200 a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe"C:\Users\Admin\AppData\Local\Temp\a5ff4846c69815fc36301e12232f855a46bc3ff92f7bc47884e375e180eebf18.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD53967fb52c5a691eb6110e63b5c349803
SHA1ae69f45ad68534f065a6bb015ea9b3dcb9ab5bdc
SHA256a11415793c1de9a3c52f1b50d1a98e4a628e4e00cc6908d0d9a7e1b0d76df5a2
SHA512e557bde68412473ee62292e1e76ef3eeebbd7dbc184d17a537722935b1fade090d62756446c4836a949a2935625bf475f9b2dabf3a2912ed7dc541bba5282ea7