6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe
Size

200KB
MD5

8b8c6b61830e675795e90919082344a4
SHA1

fc718d7b0336ed7f02cd288058b1643cc11a7b1b
SHA256

6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924
SHA512

316bd800c65cb6146b044d17896c259ac95a2620ade520036aa8ef750bc2bf2dde2d8fbf697831e1b9edf56c38d68899a80232755cc3bb4c94fb349bbd22f024
SSDEEP

6144:myT0PGxVWm56NcxRrwOsZEf4IGj17E4jRx6uG1B7u:m2xEm0c3rwVsk1w4AuG1BC

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2728	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2728	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2728	2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe	31
PID 2520 wrote to memory of 2728	2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe	31
PID 2520 wrote to memory of 2728	2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe	31
PID 2520 wrote to memory of 2728	2520	6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe	31

C:\Users\Admin\AppData\Local\Temp\6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe
"C:\Users\Admin\AppData\Local\Temp\6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe
  C:\Users\Admin\AppData\Local\Temp\6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6714472a99fd67b901786b87a377fd0598ad2dd823dcc977ecf4dce6b2f9e924.exe

Filesize
200KB

MD5
35b74b166eb738c73e317c225ed62866

SHA1
def3a164c5696f983dc14782f286932711ccf5fa

SHA256
7068d7738630f8afaf095a81fce6cf27945ce4e5df423ddc2372f666755aa639

SHA512
1a910db8285dad226866ee131a628464029214600b5b8242a80b1eca8284549f76398429e8d8469a3c97122ba3ffd1b9a559e35f7f5a4e628397391833769567

Download Submit
memory/2520-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2520-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2520-6-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download
memory/2728-11-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2728-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2728-17-0x0000000000130000-0x000000000016F000-memory.dmp

Filesize
252KB

Download