2757c40c3c771fbd296f5efb6d9a51d82e3504e4d5ab7810af1d3bef51d0f2e9

Analysis

max time kernel
108s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31ba343115ad170d9e12a7f18aa9ef20N.exe
Size

6.0MB
MD5

31ba343115ad170d9e12a7f18aa9ef20
SHA1

700aab1a6404c9e2f4322356b2e2fac595827ed6
SHA256

2757c40c3c771fbd296f5efb6d9a51d82e3504e4d5ab7810af1d3bef51d0f2e9
SHA512

1d2b5641d4b443803c2e00256f6e5cd44c0b2b12f86c4e0e9ad7c4a668f1d700743a0fe26993d785f4dbf5155aa610efee26544f391a197020dd5ab49df41ad7
SSDEEP

98304:emhd1UryeHtAvxUBV8BVmB5V7wQqZUha5jtSyZIUS:elntExUfmVA52QbaZtlir

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
436	80C9.tmp

Executes dropped EXE 1 IoCs

pid	Process
436	80C9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31ba343115ad170d9e12a7f18aa9ef20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80C9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 436	3032	31ba343115ad170d9e12a7f18aa9ef20N.exe	87
PID 3032 wrote to memory of 436	3032	31ba343115ad170d9e12a7f18aa9ef20N.exe	87
PID 3032 wrote to memory of 436	3032	31ba343115ad170d9e12a7f18aa9ef20N.exe	87

C:\Users\Admin\AppData\Local\Temp\31ba343115ad170d9e12a7f18aa9ef20N.exe
"C:\Users\Admin\AppData\Local\Temp\31ba343115ad170d9e12a7f18aa9ef20N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\80C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\80C9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\31ba343115ad170d9e12a7f18aa9ef20N.exe B638CBAB525BF514AC6C2C80B04B995ABAAD84436CF123C32E583FD064EA5D7CF32B8DBEED8E9062495AEEB1280ABDE634B0E0240D33E54C741E2B49A683770E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80C9.tmp

Filesize
6.0MB

MD5
885af3a2ac67c429e638285ba7440cc5

SHA1
0a3344102d371255223ae4b3bf7cd9fd22852a9e

SHA256
44dd40f8b672a3fe5dcf580252f0df95cbd4b6dcc8130402ddad97b5dc7aa031

SHA512
7e0342647ace3677503dc42b8cd034c7326ef016354d0594ea3724b412b857634b52843417b1867868420660183f3d4af85867dbcf2d5270bdc44edf03c7211f

Download Submit
memory/436-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/3032-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download