82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007

Analysis

max time kernel
124s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe
Size

266KB
MD5

be902a52fe0c15b92071bed01889fcb1
SHA1

d6f958076894efafa4335379dae2dcef144c8de4
SHA256

82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007
SHA512

1e98656a0ddeed72443f24ef2f17166bc501f78014d35c39d645c45e73a9caae76a120ccb6ad45667ce5e014e0ca7bb44a88ca1b65ebcd78ae57e6d7c29a8ab8
SSDEEP

6144:7XzKdNY49u8rVRI4cj3VUKIpBd4WT0BjeB:Ea4AaI4cxfI/0B

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe

Executes dropped EXE 2 IoCs

Processes:

ITS SB App Switch.exeITS SB App Switch.exe

pid process

856 ITS SB App Switch.exe
2132 ITS SB App Switch.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/1460-0-0x0000000000BE0000-0x0000000000C80000-memory.dmp upx
behavioral1/memory/1460-20-0x0000000000BE0000-0x0000000000C80000-memory.dmp upx
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
856	ITS SB App Switch.exe
2132	ITS SB App Switch.exe

resource	yara_rule
behavioral1/memory/1460-0-0x0000000000BE0000-0x0000000000C80000-memory.dmp	upx
behavioral1/memory/1460-20-0x0000000000BE0000-0x0000000000C80000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe

pid	process
1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe
1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe
1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe
1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe

description	pid	process	target process
PID 1460 wrote to memory of 856	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe
PID 1460 wrote to memory of 856	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe
PID 1460 wrote to memory of 856	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe
PID 1460 wrote to memory of 2132	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe
PID 1460 wrote to memory of 2132	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe
PID 1460 wrote to memory of 2132	1460	82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe	ITS SB App Switch.exe

C:\Users\Admin\AppData\Local\Temp\82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe
"C:\Users\Admin\AppData\Local\Temp\82e5d5157db8f2744b4c83a6657614dcd06014a32cbd0d4af0bb60c49063e007.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
2⤵
- Executes dropped EXE
PID:856

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
2⤵
- Executes dropped EXE
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4316,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
1⤵
PID:5060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
Filesize
137KB

MD5
8e277c55b2b8f512823e5c384d0e2177

SHA1
371f387b9860191a51b4b830ce8c060df4b3586b

SHA256
bb9a8cd5a67af174554effd9cbebb23dca4d1acccf4b06f183430e0a7a11f46e

SHA512
854499bff4b6802b66a14f5d7d347c0fd4648e9dad548b2f6dddf5e73a91b177e9334fcb47a23e0ac53343d27082a914225e0e4dae6b0a5dedf058251d1f9112

Download Submit
memory/1460-0-0x0000000000BE0000-0x0000000000C80000-memory.dmp

Filesize
640KB

Download
memory/1460-20-0x0000000000BE0000-0x0000000000C80000-memory.dmp

Filesize
640KB

Download