849d56ebcfdc2cb97c4a7ab9c961c3b7b80700d43963b7db2b6934609de6104d

Resubmissions

25/07/2024, 16:51

240725-vcxtksscrq 7

25/07/2024, 16:45

240725-t9tmravhje 8

25/07/2024, 16:32

240725-t2f2pavdjg 7

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

patch.exe
Size

129KB
MD5

f3f183ba8a3c43dfcbef0396ad5d917b
SHA1

8a6edcfa27a7f29cab0d6e2f0595eec2c8b2c123
SHA256

849d56ebcfdc2cb97c4a7ab9c961c3b7b80700d43963b7db2b6934609de6104d
SHA512

2b997fa759e206ac1576615e048f0f11665c2ae57abe55e780022796c02214aaf66fbe6d7ea37152908f833ab8c6ddbdf9a53fa96910f499aa9850e6e3170c77
SSDEEP

3072:uNDCOSp3CvdHOcJn+UAQBRnLEH+JkMZOuYfc0WN:kSpwlrJiARO+jOVfl

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1712	patch.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
55KB

MD5
0aed5af9cae586f68e77d952e2df6e38

SHA1
6bfa5f7f33089145911ec87936aa2454a8a70455

SHA256
ec98d49254b648dae0dafc81f2ea9f2a71fee1c7c21a11640f30d9b9b501693c

SHA512
9dc72e67d04b2feb8b0ec03a48abe6bdf18696adf5fe479794080e8f3a48011e6b1b9948e49f1b5979f92e4cc9da7716d326009816e4af9d889b50e56c2b5253

Download Submit
memory/1712-3-0x0000000074DF0000-0x0000000074E16000-memory.dmp

Filesize
152KB

Download