Analysis
-
max time kernel
134s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 11:11
Static task
static1
Behavioral task
behavioral1
Sample
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Resource
win11-20240709-en
General
-
Target
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
-
Size
929KB
-
MD5
1f5c95d40c06c01300f0a6592945a72d
-
SHA1
79a217ed19833efcf640ffd8bb04803e9f30d6f4
-
SHA256
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc
-
SHA512
3cd70090e071e43b22a3638d8cdf13874c5da34aff2cb314e170feda59d630594314f45708797d83a47ed645a7f07755ac10f4a438858e6673ce560fe5f57975
-
SSDEEP
24576:yXRv6h6aYfy8hbsv4IFlwLa15cAJAiV8KObLDCmCeBaOmXi:4JpTw8kJH8hCmvAOGi
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription pid process target process PID 4004 set thread context of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3048 1552 WerFault.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exepid process 1552 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 1552 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription pid process target process PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 4004 wrote to memory of 1552 4004 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 1843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 15521⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1552-10-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1552-14-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1552-13-0x00000000015A0000-0x00000000018EA000-memory.dmpFilesize
3.3MB
-
memory/4004-6-0x0000000006570000-0x000000000658A000-memory.dmpFilesize
104KB
-
memory/4004-4-0x00000000050F0000-0x00000000050FA000-memory.dmpFilesize
40KB
-
memory/4004-5-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/4004-0-0x000000007494E000-0x000000007494F000-memory.dmpFilesize
4KB
-
memory/4004-7-0x0000000006090000-0x000000000609E000-memory.dmpFilesize
56KB
-
memory/4004-8-0x00000000060F0000-0x000000000617E000-memory.dmpFilesize
568KB
-
memory/4004-9-0x0000000006370000-0x000000000640C000-memory.dmpFilesize
624KB
-
memory/4004-3-0x0000000004F30000-0x0000000004FC2000-memory.dmpFilesize
584KB
-
memory/4004-12-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/4004-2-0x00000000054E0000-0x0000000005A84000-memory.dmpFilesize
5.6MB
-
memory/4004-1-0x0000000000450000-0x000000000053E000-memory.dmpFilesize
952KB