c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe
Size

9.0MB
MD5

caa163258817f1b691f65fd9888ccc8b
SHA1

3c210cbb08b499497edfbb4298ca6b88692640e8
SHA256

c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4
SHA512

0925fcadcb42137ccdcc9fc9d6f2eff8b5758ab6902cb73562f83f90e79f684894e3c8dcba4b68da0811d738ca467cb976bee1a01ea4489636e94ccb8e044729
SSDEEP

196608:aKbQTFMROAgwKIBbzal7pqd46/WZPz6xrGF36yhj:aUQBMgJtl7ph6/W5d364j

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe

pid	process
2488	c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe
2488	c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe

C:\Users\Admin\AppData\Local\Temp\c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe
"C:\Users\Admin\AppData\Local\Temp\c2d4225a8dd180e87aed7489da9f1d2bc6b38f7507ca52fc9cdbf55efa4446a4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjA786.tmp\UserInfo.dll

Filesize
4KB

MD5
2f69afa9d17a5245ec9b5bb03d56f63c

SHA1
e0a133222136b3d4783e965513a690c23826aec9

SHA256
e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0

SHA512
bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926

Download Submit