3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe
Size

59KB
MD5

ee386bb0408691df751c53f0aca10d85
SHA1

8fea9949f907bf40fa56827f1e19f11a2b7db7b7
SHA256

3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c
SHA512

18193dcf000900e4dfc3a768b6e558d93c8bb2e09cf750b8cbb51710ce2c300ab8c94b72263185d27ee78cf6424a5e8861f30cf0c1fed1b6bb72735ad73206a5
SSDEEP

1536:xr+xnx6hC9vZIfqTyxUYu6NLC2JakSBlxLkEI:x4x6hOvZIfXxUYx22sk4

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2156	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Loads dropped DLL 1 IoCs

pid	Process
2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x0009000000012286-15.dat	upx
behavioral1/memory/2156-16-0x0000000000400000-0x000000000043D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe
2156	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2156	2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe	31
PID 2984 wrote to memory of 2156	2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe	31
PID 2984 wrote to memory of 2156	2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe	31
PID 2984 wrote to memory of 2156	2984	3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe	31

C:\Users\Admin\AppData\Local\Temp\3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe
"C:\Users\Admin\AppData\Local\Temp\3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe
  C:\Users\Admin\AppData\Local\Temp\3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3782c0a93f9db0c032c67a3757e3eeedb3d89482870b7b6c9d13209997c0ef9c.exe

Filesize
59KB

MD5
4f508df1ff5ea5b1250c6a9c9f05c668

SHA1
09bd4aa9957981d8afba527f73d7d8ef4a8633ca

SHA256
a6ad744f6edc7359a67114b53f23d625235f7aa378756edb1a53958284e8f09f

SHA512
bf64b96b9eeea3552bc123a9aed8025e9511c9711a4151136c8502a7a88fc2a20b6b057edd0ac8481d8aed748a64f1c59f8e5b6ca64afcd0711903802866ace7

Download Submit
memory/2156-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2156-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2156-22-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2156-27-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2156-28-0x0000000000170000-0x000000000018D000-memory.dmp

Filesize
116KB

Download
memory/2156-30-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2984-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2984-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2984-14-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2984-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2984-29-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download