Analysis
- max time kernel
93s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 16:09
General
- Target Duplicate_Check_Local_Server.exe
- Size 288.9MB
- Sample240612-tl7vgavekm
- SHA256 be9a70961be290dff98c0910938dd8508882485c5d027ea3cce93d9166f04c9d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 25 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Duplicate_Check_Local_Server.exe"C:\Users\Admin\AppData\Local\Temp\Duplicate_Check_Local_Server.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\E4J504~1.TMP\jre\bin\java.exe"c:\users\admin\appdata\local\temp\E4J504~1.TMP\jre\bin\java.exe" -version2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
awt.dll
fontmanager.dll
freetype.dll
java.exe
management.dll
management_ext.dll
net.dll
nio.dll
prefs.dll
sunmscapi.dll
zip.dll
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
i4j_nlog_1.log
i4j_nlog_1.log
i4j_nlog_1.log
i4j_nlog_1.log
i4j_nlog_1.log
i4j_nlog_1.log
i4j_nlog_1.log
VCRUNTIME140.dll
java.dll
jimage.dll
jli.dll
jsvml.dll
msvcp140.dll
jvm.dll
vcruntime140_1.dll
jvm.cfg
memory/4696-1746-0x0000023493480000-0x0000023493490000-memory.dmp
memory/4696-1776-0x0000023493600000-0x0000023493610000-memory.dmp
memory/4696-1636-0x000002349ACB0000-0x000002349AF20000-memory.dmp
memory/4696-1625-0x000002349A720000-0x000002349A990000-memory.dmp
memory/4696-1696-0x0000023493460000-0x0000023493470000-memory.dmp
memory/4696-1698-0x0000023493470000-0x0000023493480000-memory.dmp
memory/4696-1703-0x0000023493480000-0x0000023493490000-memory.dmp
memory/4696-1705-0x0000023493490000-0x00000234934A0000-memory.dmp
memory/4696-1707-0x00000234934A0000-0x00000234934B0000-memory.dmp
memory/4696-1709-0x00000234934B0000-0x00000234934C0000-memory.dmp
memory/4696-1711-0x00000234934C0000-0x00000234934D0000-memory.dmp
memory/4696-1840-0x00000234936E0000-0x00000234936F0000-memory.dmp
memory/4696-1715-0x00000234934D0000-0x00000234934E0000-memory.dmp
memory/4696-1729-0x000002349ACB0000-0x000002349AF20000-memory.dmp
memory/4696-1738-0x0000023493460000-0x0000023493470000-memory.dmp
memory/4696-1737-0x0000023493530000-0x0000023493540000-memory.dmp
memory/4696-1736-0x0000023493540000-0x0000023493550000-memory.dmp
memory/4696-1735-0x0000023493520000-0x0000023493530000-memory.dmp
memory/4696-1734-0x00000234931F0000-0x0000023493460000-memory.dmp
memory/4696-1728-0x00000234934F0000-0x0000023493500000-memory.dmp
memory/4696-1727-0x00000234934E0000-0x00000234934F0000-memory.dmp
memory/4696-1726-0x0000023493510000-0x0000023493520000-memory.dmp
memory/4696-1725-0x0000023493500000-0x0000023493510000-memory.dmp
memory/4696-1723-0x000002349A720000-0x000002349A990000-memory.dmp
memory/4696-1839-0x00000234936D0000-0x00000234936E0000-memory.dmp
memory/4696-1742-0x0000023493550000-0x0000023493560000-memory.dmp
memory/4696-1743-0x0000023493560000-0x0000023493570000-memory.dmp
memory/4696-1741-0x0000023493470000-0x0000023493480000-memory.dmp
memory/4696-1747-0x0000023493570000-0x0000023493580000-memory.dmp
memory/4696-1748-0x0000023493580000-0x0000023493590000-memory.dmp
memory/4696-1838-0x00000234936C0000-0x00000234936D0000-memory.dmp
memory/4696-1751-0x0000023493590000-0x00000234935A0000-memory.dmp
memory/4696-1750-0x0000023493490000-0x00000234934A0000-memory.dmp
memory/4696-1754-0x00000234934A0000-0x00000234934B0000-memory.dmp
memory/4696-1755-0x00000234935A0000-0x00000234935B0000-memory.dmp
memory/4696-1756-0x00000234934B0000-0x00000234934C0000-memory.dmp
memory/4696-1757-0x00000234935B0000-0x00000234935C0000-memory.dmp
memory/4696-1765-0x00000234935D0000-0x00000234935E0000-memory.dmp
memory/4696-1764-0x00000234935C0000-0x00000234935D0000-memory.dmp
memory/4696-1763-0x00000234934C0000-0x00000234934D0000-memory.dmp
memory/4696-1773-0x00000234935F0000-0x0000023493600000-memory.dmp
memory/4696-1772-0x00000234935E0000-0x00000234935F0000-memory.dmp
memory/4696-1771-0x0000023493510000-0x0000023493520000-memory.dmp
memory/4696-1770-0x0000023493500000-0x0000023493510000-memory.dmp
memory/4696-1769-0x00000234934D0000-0x00000234934E0000-memory.dmp
memory/4696-1635-0x00000234931F0000-0x0000023493460000-memory.dmp
memory/4696-1778-0x0000023493520000-0x0000023493530000-memory.dmp
memory/4696-1780-0x0000023493610000-0x0000023493620000-memory.dmp
memory/4696-1779-0x0000023493540000-0x0000023493550000-memory.dmp
memory/4696-1784-0x0000023493620000-0x0000023493630000-memory.dmp
memory/4696-1783-0x0000023493530000-0x0000023493540000-memory.dmp
memory/4696-1792-0x0000023493570000-0x0000023493580000-memory.dmp
memory/4696-1794-0x0000023493650000-0x0000023493660000-memory.dmp
memory/4696-1793-0x0000023493580000-0x0000023493590000-memory.dmp
memory/4696-1790-0x0000023493640000-0x0000023493650000-memory.dmp
memory/4696-1789-0x0000023493630000-0x0000023493640000-memory.dmp
memory/4696-1787-0x0000023493560000-0x0000023493570000-memory.dmp
memory/4696-1786-0x0000023493550000-0x0000023493560000-memory.dmp
memory/4696-1797-0x0000023493660000-0x0000023493670000-memory.dmp
memory/4696-1796-0x0000023493590000-0x00000234935A0000-memory.dmp
memory/4696-1801-0x0000023493670000-0x0000023493680000-memory.dmp
memory/4696-1800-0x00000234935A0000-0x00000234935B0000-memory.dmp
memory/4696-1803-0x0000023493680000-0x0000023493690000-memory.dmp
memory/4696-1802-0x00000234935B0000-0x00000234935C0000-memory.dmp
memory/4696-1812-0x00000234935F0000-0x0000023493600000-memory.dmp
memory/4696-1811-0x00000234935E0000-0x00000234935F0000-memory.dmp
memory/4696-1810-0x00000234936A0000-0x00000234936B0000-memory.dmp
memory/4696-1809-0x0000023493690000-0x00000234936A0000-memory.dmp
memory/4696-1808-0x00000234935D0000-0x00000234935E0000-memory.dmp
memory/4696-1807-0x00000234935C0000-0x00000234935D0000-memory.dmp
memory/4696-1816-0x0000023493600000-0x0000023493610000-memory.dmp
memory/4696-1818-0x00000234936B0000-0x00000234936C0000-memory.dmp
memory/4696-1821-0x0000023493610000-0x0000023493620000-memory.dmp
memory/4696-1828-0x00000234936F0000-0x0000023493700000-memory.dmp
memory/4696-1827-0x00000234936E0000-0x00000234936F0000-memory.dmp
memory/4696-1826-0x0000023493620000-0x0000023493630000-memory.dmp
memory/4696-1820-0x00000234936D0000-0x00000234936E0000-memory.dmp
memory/4696-1819-0x00000234936C0000-0x00000234936D0000-memory.dmp
memory/4696-1829-0x0000023493630000-0x0000023493640000-memory.dmp
memory/4696-1830-0x0000023493640000-0x0000023493650000-memory.dmp
memory/4696-1831-0x0000023493650000-0x0000023493660000-memory.dmp
memory/4696-1832-0x0000023493660000-0x0000023493670000-memory.dmp
memory/4696-1833-0x0000023493670000-0x0000023493680000-memory.dmp
memory/4696-1834-0x0000023493680000-0x0000023493690000-memory.dmp
memory/4696-1835-0x0000023493690000-0x00000234936A0000-memory.dmp
memory/4696-1836-0x00000234936A0000-0x00000234936B0000-memory.dmp
memory/4696-1837-0x00000234936B0000-0x00000234936C0000-memory.dmp
memory/4796-1537-0x000002085F010000-0x000002085F280000-memory.dmp
memory/4796-1548-0x000002085F5A0000-0x000002085F810000-memory.dmp
memory/4796-1551-0x000002085F010000-0x000002085F280000-memory.dmp