94b5a5cc5729f6531032abf15914f57f7f6f6f7cb31fa816373e412ec4ade1fd

Analysis

max time kernel
51s
max time network
19s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-07-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UltimMC/UltimMC.exe
Size

9.0MB
MD5

a5ea596fa893adc653ee52ae3823aa73
SHA1

3bed6270d4cc454bd8ebc1e9425eb9dc8072f507
SHA256

25e110faf23ec73a9e2acb8203cfceebeabe1dbbb42cee4442c24be978e6b367
SHA512

79180e0c33739ee9a86b5b94b631b201f43ebdc1ae0605cb2fed7bbbd75038b727ccc55e1d0c8ce3c8a62bb6465783b15fa880097e67586192d6e5271be427fa
SSDEEP

196608:ZVPBNOvuv4yz6rPfc6pPyaWBfhw5aq7W2quk2/VxV3V8O9iV5VVcKV0PgVX/VVN/:d8W76r2U7rBVxV3V8O9iV5VVcKV0PgVN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

UltimMC.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltimMC.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

UltimMC.exe

pid process

3168 UltimMC.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

UltimMC.exe

pid process

3168 UltimMC.exe
3168 UltimMC.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

UltimMC.exe

pid process

3168 UltimMC.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

UltimMC.exe

pid process

3168 UltimMC.exe
3168 UltimMC.exe
3168 UltimMC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UltimMC.exe

pid	process
3168	UltimMC.exe

pid	process
3168	UltimMC.exe
3168	UltimMC.exe

pid	process
3168	UltimMC.exe

pid	process
3168	UltimMC.exe
3168	UltimMC.exe
3168	UltimMC.exe

C:\Users\Admin\AppData\Local\Temp\UltimMC\UltimMC.exe
"C:\Users\Admin\AppData\Local\Temp\UltimMC\UltimMC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3168

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x00000000014C0000-0x0000000001A35000-memory.dmp

Filesize
5.5MB

Download
memory/3168-7-0x0000000068881000-0x0000000068B29000-memory.dmp

Filesize
2.7MB

Download
memory/3168-8-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/3168-6-0x0000000000400000-0x0000000000A3D000-memory.dmp

Filesize
6.2MB

Download
memory/3168-3-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/3168-5-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/3168-2-0x00000000014C0000-0x0000000001A35000-memory.dmp

Filesize
5.5MB

Download
memory/3168-4-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/3168-15-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/3168-17-0x00000000055E0000-0x00000000057F2000-memory.dmp

Filesize
2.1MB

Download
memory/3168-32-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/3168-31-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/3168-34-0x00000000014C0000-0x0000000001A35000-memory.dmp

Filesize
5.5MB

Download
memory/3168-33-0x0000000061DC0000-0x0000000062404000-memory.dmp

Filesize
6.3MB

Download
memory/3168-37-0x00000000055E0000-0x00000000057F2000-memory.dmp

Filesize
2.1MB

Download
memory/3168-36-0x000000006A880000-0x000000006A9F6000-memory.dmp

Filesize
1.5MB

Download
memory/3168-35-0x0000000000110000-0x000000000011C000-memory.dmp

Filesize
48KB

Download
memory/3168-30-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/3168-29-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/3168-28-0x0000000066C00000-0x0000000066C3E000-memory.dmp

Filesize
248KB

Download
memory/3168-27-0x0000000069700000-0x0000000069894000-memory.dmp

Filesize
1.6MB

Download
memory/3168-26-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download
memory/3168-25-0x0000000063400000-0x0000000063415000-memory.dmp

Filesize
84KB

Download
memory/3168-21-0x0000000000400000-0x0000000000A3D000-memory.dmp

Filesize
6.2MB

Download
memory/3168-22-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/3168-24-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/3168-23-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/3168-68-0x00000000014C0000-0x0000000001A35000-memory.dmp

Filesize
5.5MB

Download