8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe
Size

821KB
MD5

67af4dad11c9a92587bceb56138e6c99
SHA1

26bf25d451c1927d2efa34acdbf11ff8b52e3991
SHA256

8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045
SHA512

6df94280fe9829f1b5a91d49b732c4cc4b0601ea92adeeff6f74100c9116acb8859518068fb30625a38fd684e347b44a68d34b058d2583dc56144832408aa17b
SSDEEP

24576:UTko83eT46NzUOPmAAEXSeoCxrwl2LZmN1SafY:UTko8iGECeo3yZmXvfY

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	16BC.tmp

Executes dropped EXE 1 IoCs

pid	Process
2700	16BC.tmp

Loads dropped DLL 1 IoCs

pid	Process
824	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16BC.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2700	824	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe	30
PID 824 wrote to memory of 2700	824	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe	30
PID 824 wrote to memory of 2700	824	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe	30
PID 824 wrote to memory of 2700	824	8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe	30

C:\Users\Admin\AppData\Local\Temp\8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe
"C:\Users\Admin\AppData\Local\Temp\8decc5bc0d9d7dcd304e99ed0fa502f4daf619c63872652fe9bf709a8e30c045.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\16BC.tmp
  "C:\Users\Admin\AppData\Local\Temp\16BC.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\16BC.tmp

Filesize
821KB

MD5
6da6e218a8201fa98783ac56bdff4d88

SHA1
8cf22e40c4464ee6e76db11d6e87b70e870edb6f

SHA256
cbd6c667397c5fdaf4df4b5c5150fd2c8ef055c9c9a79d7f83058165ffa9e21a

SHA512
a4c17dd643d500d5d51768f79d12c0db1150fce0ba2ec99144670fa018afbc68d9e3ba16f23a26df7f2551ac21628f6be52a221e00ff1adc6c7be97664922b16

Download Submit
memory/824-0-0x00000000002A0000-0x000000000036A000-memory.dmp

Filesize
808KB

Download
memory/824-7-0x00000000002A0000-0x000000000036A000-memory.dmp

Filesize
808KB

Download
memory/824-5-0x0000000001EB0000-0x0000000001F7A000-memory.dmp

Filesize
808KB

Download
memory/2700-8-0x00000000013D0000-0x000000000149A000-memory.dmp

Filesize
808KB

Download
memory/2700-9-0x00000000013D0000-0x000000000149A000-memory.dmp

Filesize
808KB

Download