80f4ee6db5dcacfb44746e92828f0da9146905d3cf09bab7a4d601e9aac27a65

Analysis

max time kernel
101s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f568d62b91609e52c424414f7f3d300N.exe
Size

350KB
MD5

8f568d62b91609e52c424414f7f3d300
SHA1

e698be566cd4e9a1915c3ceceb2695166a99f12e
SHA256

80f4ee6db5dcacfb44746e92828f0da9146905d3cf09bab7a4d601e9aac27a65
SHA512

52e55a007dbc86d5c0d81f0b5321275fa766db33eb5acb61d533f19d740a85de855eaafcc4bea90deee798d154bc02e95555734efb2bcce740914e35339de2f5
SSDEEP

6144:Ll44rrWHbRwcgPIQz43wEUk0s/7TA2dd+FhawLSkghfkgpHyhXW:L+ErsbROdMwEUk0s/fA22MvkEsW

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1884	8f568d62b91609e52c424414f7f3d300N.exe

Executes dropped EXE 1 IoCs

pid	Process
1884	8f568d62b91609e52c424414f7f3d300N.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	8f568d62b91609e52c424414f7f3d300N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f568d62b91609e52c424414f7f3d300N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f568d62b91609e52c424414f7f3d300N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	8f568d62b91609e52c424414f7f3d300N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2320	8f568d62b91609e52c424414f7f3d300N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1884	8f568d62b91609e52c424414f7f3d300N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1884	2320	8f568d62b91609e52c424414f7f3d300N.exe	30
PID 2320 wrote to memory of 1884	2320	8f568d62b91609e52c424414f7f3d300N.exe	30
PID 2320 wrote to memory of 1884	2320	8f568d62b91609e52c424414f7f3d300N.exe	30
PID 2320 wrote to memory of 1884	2320	8f568d62b91609e52c424414f7f3d300N.exe	30

C:\Users\Admin\AppData\Local\Temp\8f568d62b91609e52c424414f7f3d300N.exe
"C:\Users\Admin\AppData\Local\Temp\8f568d62b91609e52c424414f7f3d300N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\8f568d62b91609e52c424414f7f3d300N.exe
  C:\Users\Admin\AppData\Local\Temp\8f568d62b91609e52c424414f7f3d300N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8f568d62b91609e52c424414f7f3d300N.exe

Filesize
350KB

MD5
3c9f52b45ac6e8228f645af460be87b0

SHA1
1f6ebec6d0adc5873247c6a1d496065ccfa986f8

SHA256
27033a212acb6a4e8602a505316b078982d3c32e9de95e0c5a8279d8ba887339

SHA512
df4bca79f5ff4e6fa7acc300555ccf612f1daea5f28a44e6c1cb0442c07c5a4a57a0d647072b1b3c83461c56abd59f409a9298f2d01442e363e95573f67ef39a

Download Submit
memory/1884-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1884-17-0x0000000000210000-0x0000000000243000-memory.dmp

Filesize
204KB

Download
memory/2320-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download