894a461e0d709023ba6ec45f748b38a79ae12cf398702244ef2ffa93dd644133

Analysis

max time kernel
114s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adab89a1b7da6ae4c96646563b0c506f.exe
Size

7KB
MD5

adab89a1b7da6ae4c96646563b0c506f
SHA1

b20a04b6783bb1084b11db58fac6c8b212109717
SHA256

9804ead50696e545955543c470bdbbe3859f714278acc47e3c9c2a092ddd9b2d
SHA512

2905df01b7e30a2d1bcac38e7d02d97494854bfb3d5412e79b758a21f439436c984f312d6a5c78cd47d40df7f4402582cf6a20b1686f693c21e11920b59b2190
SSDEEP

192:/LecMoaS0KtNdaLix8qiG/VunlYJLLLTu6n2qS+:/LecMoaSjzdaLiYOhPLTu6zS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	adab89a1b7da6ae4c96646563b0c506f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 644	5936	adab89a1b7da6ae4c96646563b0c506f.exe	85
PID 5936 wrote to memory of 644	5936	adab89a1b7da6ae4c96646563b0c506f.exe	85
PID 644 wrote to memory of 1404	644	cmd.exe	87
PID 644 wrote to memory of 1404	644	cmd.exe	87
PID 1404 wrote to memory of 208	1404	net.exe	88
PID 1404 wrote to memory of 208	1404	net.exe	88

C:\Users\Admin\AppData\Local\Temp\adab89a1b7da6ae4c96646563b0c506f.exe
"C:\Users\Admin\AppData\Local\Temp\adab89a1b7da6ae4c96646563b0c506f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\system32\net.exe
    net user Admin *
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin *
      4⤵
      PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmd.bat

Filesize
189B

MD5
f2fdc4b2ed14c03566adab02abadc89e

SHA1
bc16324ab27ad25516b3db42d6e915d9b6d029cf

SHA256
82f36254f9ba3303a7c1a5f58b69532096afef76e21b2f35d18e00938513d525

SHA512
385e516376dc164e7a370ba1c94b1b06d354a294ecfdcd95dd9527f135a81ff90bcb92d34537f60499f9804b04848928a2f300ec6cbde288d2364e90ef2e733f

Download Submit
memory/5936-1-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/5936-0-0x00007FFCA1C03000-0x00007FFCA1C05000-memory.dmp

Filesize
8KB

Download