55a441e5fcfc96bcd30966a7793cdf52ca9ff5b1c4a1fd2186bdfc9891ba37bb

Analysis

max time kernel
20s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55ac0368fe1bb81a5cc6656ebce48d40N.exe
Size

4.1MB
MD5

55ac0368fe1bb81a5cc6656ebce48d40
SHA1

c4ccc98c7e58e3d909f6c813aed3ccd248daf174
SHA256

55a441e5fcfc96bcd30966a7793cdf52ca9ff5b1c4a1fd2186bdfc9891ba37bb
SHA512

b0913b551f8b798378c34d54c175bfbd7e3875de4ba7c16d93e3b5460b5ffc30201a76da9b81422c90f24f56965ced64c8f5473d7eff1207ae0f37aed5e3db3b
SSDEEP

24576:pdiq3bjWJczWHOkaPZSVTb+eezha/ZSbpYvxYTqD2Rkea/ZSAajJBMqAX1Ea/pSb:3V3bqJcz2lQ6XMhgSVgCo/OgTw

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe

Executes dropped EXE 1 IoCs

pid	Process
2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe

Loads dropped DLL 4 IoCs

pid	Process
2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2820	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55ac0368fe1bb81a5cc6656ebce48d40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55ac0368fe1bb81a5cc6656ebce48d40N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2820	2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe	31
PID 2252 wrote to memory of 2820	2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe	31
PID 2252 wrote to memory of 2820	2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe	31
PID 2252 wrote to memory of 2820	2252	55ac0368fe1bb81a5cc6656ebce48d40N.exe	31
PID 2820 wrote to memory of 2760	2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe	32
PID 2820 wrote to memory of 2760	2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe	32
PID 2820 wrote to memory of 2760	2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe	32
PID 2820 wrote to memory of 2760	2820	55ac0368fe1bb81a5cc6656ebce48d40N.exe	32

C:\Users\Admin\AppData\Local\Temp\55ac0368fe1bb81a5cc6656ebce48d40N.exe
"C:\Users\Admin\AppData\Local\Temp\55ac0368fe1bb81a5cc6656ebce48d40N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\55ac0368fe1bb81a5cc6656ebce48d40N.exe
  C:\Users\Admin\AppData\Local\Temp\55ac0368fe1bb81a5cc6656ebce48d40N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\55ac0368fe1bb81a5cc6656ebce48d40N.exe

Filesize
4.1MB

MD5
8f1d0949a40d928b4660c391eb15b296

SHA1
8bdb7b85fb4508577bdcca2678f4edd58ee2612b

SHA256
39a172af458fb7d1c6d07276a804bccfcb5fd41ba3dd84da9f3526c57ebcf6bc

SHA512
95c268550a7e752d839ecc1296c554a3d1c930af7d60d015969b8ffed525820a64d63b3dd225091db32ea9a3f2d9703074a185ed52aea6f62fae44df02bfdf65

Download Submit
memory/2252-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2252-7-0x00000000014F0000-0x00000000015DC000-memory.dmp

Filesize
944KB

Download
memory/2252-10-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2820-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2820-11-0x0000000002E80000-0x0000000002F6C000-memory.dmp

Filesize
944KB

Download