Analysis
-
max time kernel
134s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Resource
win10v2004-20240709-en
General
-
Target
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
-
Size
929KB
-
MD5
1f5c95d40c06c01300f0a6592945a72d
-
SHA1
79a217ed19833efcf640ffd8bb04803e9f30d6f4
-
SHA256
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc
-
SHA512
3cd70090e071e43b22a3638d8cdf13874c5da34aff2cb314e170feda59d630594314f45708797d83a47ed645a7f07755ac10f4a438858e6673ce560fe5f57975
-
SSDEEP
24576:yXRv6h6aYfy8hbsv4IFlwLa15cAJAiV8KObLDCmCeBaOmXi:4JpTw8kJH8hCmvAOGi
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription pid process target process PID 2692 set thread context of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2564 2928 WerFault.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exepid process 2928 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 2928 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exedescription pid process target process PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe PID 2692 wrote to memory of 2928 2692 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe 434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"C:\Users\Admin\AppData\Local\Temp\434ec59b680788bae7f2935200a77e681cecbb517d853c6e6cf31f4cf112e5cc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 1843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2928 -ip 29281⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2692-6-0x0000000005160000-0x000000000517A000-memory.dmpFilesize
104KB
-
memory/2692-0-0x000000007472E000-0x000000007472F000-memory.dmpFilesize
4KB
-
memory/2692-2-0x0000000005500000-0x0000000005AA4000-memory.dmpFilesize
5.6MB
-
memory/2692-3-0x0000000004E40000-0x0000000004ED2000-memory.dmpFilesize
584KB
-
memory/2692-4-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2692-5-0x0000000004F10000-0x0000000004F1A000-memory.dmpFilesize
40KB
-
memory/2692-1-0x0000000000380000-0x000000000046E000-memory.dmpFilesize
952KB
-
memory/2692-7-0x00000000054C0000-0x00000000054CE000-memory.dmpFilesize
56KB
-
memory/2692-12-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2692-9-0x0000000006350000-0x00000000063EC000-memory.dmpFilesize
624KB
-
memory/2692-8-0x00000000060E0000-0x000000000616E000-memory.dmpFilesize
568KB
-
memory/2928-10-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2928-13-0x00000000016B0000-0x00000000019FA000-memory.dmpFilesize
3.3MB
-
memory/2928-14-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB