c8b3fc1b0fad1a906f19802d7fd14b700c3ff9d791ea88add10699a556cef115

Analysis

max time kernel
119s
max time network
26s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
Size

280KB
MD5

7bcafa50e97a5d0ebe35cf064e91c6c0
SHA1

8f3cb214ba868e4bae1b9b4560803cc904683b9f
SHA256

c8b3fc1b0fad1a906f19802d7fd14b700c3ff9d791ea88add10699a556cef115
SHA512

5cadd86cf20036c77b9f12daf63a2b31d721b97bb01b5497353311c70daee63be71e5f8e7a7dd0fdf2b48b1de8d9faf2336a47fe02ff0cf2c3b58b5dbdb86d5c
SSDEEP

3072:R8ERv3zZZm5c4Sq+YN95wFT0z+QadjN3rOwRXENk+Y0yFNzlUu0Vv:R8EZrm55Zt5wFwz+TdpRXENFTAkVv

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

Systeamxpyqz.exe

pid process

1916 Systeamxpyqz.exe
Executes dropped EXE 1 IoCs

Processes:

Systeamxpyqz.exe

pid process

1916 Systeamxpyqz.exe
Loads dropped DLL 2 IoCs

Processes:

7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

pid process

2976 7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976 7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

pid	process
1916	Systeamxpyqz.exe

pid	process
1916	Systeamxpyqz.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

Processes:

7bcafa50e97a5d0ebe35cf064e91c6c0N.exeSysteamxpyqz.exe

pid	process
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe
1916	Systeamxpyqz.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

description	pid	process	target process
PID 2976 wrote to memory of 1916	2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe	Systeamxpyqz.exe
PID 2976 wrote to memory of 1916	2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe	Systeamxpyqz.exe
PID 2976 wrote to memory of 1916	2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe	Systeamxpyqz.exe
PID 2976 wrote to memory of 1916	2976	7bcafa50e97a5d0ebe35cf064e91c6c0N.exe	Systeamxpyqz.exe

C:\Users\Admin\AppData\Local\Temp\7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
"C:\Users\Admin\AppData\Local\Temp\7bcafa50e97a5d0ebe35cf064e91c6c0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\Systeamxpyqz.exe
"C:\Users\Admin\AppData\Local\Temp\Systeamxpyqz.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1916

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Systeamxpyqz.exe
Filesize
280KB

MD5
018f02adf006fbc599ad11ffdfa239ba

SHA1
51451ffd4c430d6b8abbad5618337fce9d90bb11

SHA256
aebcbf6dbec78f57aaa308e68be1d1e8ea60f7bc1ffb6adaac5a6fc40237d211

SHA512
fa4f26a643fb185e24482f4e5489c4fb12d953e22c54f125f4a315d96672095de0857ef25f02da85d66fd6375f75373f9d1808a418684f2b9497c35764bcacb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cpath.ini
Filesize
71B

MD5
07daa9dd06f1eb9c7571ca56744043c8

SHA1
c3177fe465d6de715c5b3c11b1d8b47849731aa9

SHA256
f6c405034f64532bf4344f96fa2985038e7a21e5455475d06fe052b1ed50b811

SHA512
9a39cceccab30e3998a5c0d1c5e91943739d129667b54d199ab1ced4413c006a4a6b5addc76136121713703d0ff83583876e22147f88e354313a265d247f9d70

Download Submit