ec57a5693533b024615c157ec0e3867b2eb73a65a12c20501ef8ff00ffd8f65c

Analysis

max time kernel
104s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cebdbe487a669e8a1bbd5c09ed5721d.exe
Size

2.1MB
MD5

7cebdbe487a669e8a1bbd5c09ed5721d
SHA1

354f2575c983e428a6ca1a4f0c4d15f69722a225
SHA256

42561b0c7f8a631b2046c23005aa5af7425e83c550973f80c306146a878edb20
SHA512

6818edd60d2ec2595e1115961862c509f9e8ba6f4a07f3fe2cabf154fc29a4992f1043b7774b0f317ebb2a7d4e40cd2aaae40ebda4127db0c1c53dcc310d7698
SSDEEP

49152:Q/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4CfS:I

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	7cebdbe487a669e8a1bbd5c09ed5721d.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	yo0mwx3i.n1p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2204	4912	7cebdbe487a669e8a1bbd5c09ed5721d.exe	88
PID 4912 wrote to memory of 2204	4912	7cebdbe487a669e8a1bbd5c09ed5721d.exe	88

C:\Users\Admin\AppData\Local\Temp\7cebdbe487a669e8a1bbd5c09ed5721d.exe
"C:\Users\Admin\AppData\Local\Temp\7cebdbe487a669e8a1bbd5c09ed5721d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\yo0mwx3i.n1p.exe
  "C:\Users\Admin\AppData\Local\Temp\yo0mwx3i.n1p.exe"
  2⤵
  - Executes dropped EXE
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yo0mwx3i.n1p.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
memory/2204-14-0x000002258F0B0000-0x000002258F176000-memory.dmp

Filesize
792KB

Download
memory/2204-15-0x00007FFBC8120000-0x00007FFBC8BE1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-17-0x00007FFBC8120000-0x00007FFBC8BE1000-memory.dmp

Filesize
10.8MB

Download
memory/4912-1-0x0000000000490000-0x00000000006AC000-memory.dmp

Filesize
2.1MB

Download
memory/4912-0-0x00007FFBC8123000-0x00007FFBC8125000-memory.dmp

Filesize
8KB

Download