a6424cc1d3efc519a6bc61eae187ab89378d374493695d5ce5a1d602eb79d223

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 15:29

Target

itranslator.exe
Size

8.2MB
MD5

39c773dc1a684e370f8850487cd31eae
SHA1

7ecf60a864c35ee9f77c1ec5587f444070769ddb
SHA256

d2286a1d9143bcaeaeef5ced8ca3e33fac408bb6b6f8e636486e74d9d451456a
SHA512

5754fc5fe7f7b98de19475064f0e46cc718c65638a8d6b8018016a780912b6df825282a2c4ae812836fb3dc34f4f42d484001583ea6fecde300f87d250d32f8d
SSDEEP

196608:OTL4wY2cxPV4X1NC6ehoulK75jDvXRCvKERWY0qEOSLtQwpuC:wmPVQLtd7BXRyKEL03

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

itranslator.exe

pid process

3008 itranslator.exe
Loads dropped DLL 1 IoCs

Processes:

itranslator.exe

pid process

2896 itranslator.exe
Drops file in Windows directory 1 IoCs

Processes:

itranslator.exe

description ioc process

File created C:\Windows\iTranslator itranslator.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

476

pid	process
3008	itranslator.exe

pid	process
2896	itranslator.exe

description	ioc	process
File created	C:\Windows\iTranslator	itranslator.exe

pid	process
476

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

itranslator.exe

description	pid	process	target process
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 2988	2896	itranslator.exe	wusa.exe
PID 2896 wrote to memory of 3008	2896	itranslator.exe	itranslator.exe
PID 2896 wrote to memory of 3008	2896	itranslator.exe	itranslator.exe
PID 2896 wrote to memory of 3008	2896	itranslator.exe	itranslator.exe
PID 2896 wrote to memory of 3008	2896	itranslator.exe	itranslator.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\ProgramData\itranslator\itranslator.exe

Filesize
4.2MB

MD5
80a1e65922f40fedd537c30c8addac9c

SHA1
e495e66552295a63c434df2739ae55031447d057

SHA256
381babc4a9782d4e2996b6e7bf8d305689c5a9049c4f617ff32428083f6f1676

SHA512
59acc5ca8b2ceb3281f0d69e2d8614c299bab32e464db0d0df0297531c97882c8796350840c6b709ef729f75d5d64e55b1abbb29509def66c03ac39d92aa0ec3

Download Submit