Overview

overview

7

Static

static

3

7bcafa50e9...0N.exe

windows7-x64

7

7bcafa50e9...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 01:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bcafa50e97a5d0ebe35cf064e91c6c0N.exe

  • Size

    280KB

  • MD5

    7bcafa50e97a5d0ebe35cf064e91c6c0

  • SHA1

    8f3cb214ba868e4bae1b9b4560803cc904683b9f

  • SHA256

    c8b3fc1b0fad1a906f19802d7fd14b700c3ff9d791ea88add10699a556cef115

  • SHA512

    5cadd86cf20036c77b9f12daf63a2b31d721b97bb01b5497353311c70daee63be71e5f8e7a7dd0fdf2b48b1de8d9faf2336a47fe02ff0cf2c3b58b5dbdb86d5c

  • SSDEEP

    3072:R8ERv3zZZm5c4Sq+YN95wFT0z+QadjN3rOwRXENk+Y0yFNzlUu0Vv:R8EZrm55Zt5wFwz+TdpRXENFTAkVv

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bcafa50e97a5d0ebe35cf064e91c6c0N.exe
    "C:\Users\Admin\AppData\Local\Temp\7bcafa50e97a5d0ebe35cf064e91c6c0N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\Systeamggjov.exe
      "C:\Users\Admin\AppData\Local\Temp\Systeamggjov.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Systeamggjov.exe
    Filesize

    280KB

    MD5

    45337e080486e18b89ad1e539d3d80b7

    SHA1

    816f9c813c18ab8e6de5235f02f4d1cde8bab959

    SHA256

    3e32c1117ad78c194e3abd58b4234a4ae4099f28a1de1362a14816cfbfbfd992

    SHA512

    4b38e868aa8c9f0a187a7e4b4ea10206aeddd7c0bc9aafe484bd50de847897d15258c6f08af3a72e2a126e3924934957b128f74373157dbfaf9f210784fce4bc

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\cpath.ini
    Filesize

    71B

    MD5

    07daa9dd06f1eb9c7571ca56744043c8

    SHA1

    c3177fe465d6de715c5b3c11b1d8b47849731aa9

    SHA256

    f6c405034f64532bf4344f96fa2985038e7a21e5455475d06fe052b1ed50b811

    SHA512

    9a39cceccab30e3998a5c0d1c5e91943739d129667b54d199ab1ced4413c006a4a6b5addc76136121713703d0ff83583876e22147f88e354313a265d247f9d70

    Download Submit