Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/07/2024, 20:46

General

  • Target

    de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe

  • Size

    7.1MB

  • MD5

    945799bf0c3ea84b4fbe73c02ebe45d3

  • SHA1

    4aaba52d3cb179d390d427576b02b9f8fca038ef

  • SHA256

    de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b

  • SHA512

    ec6ecfc7fa46ac82680b8b5bf67581f8f0578e202b22909af15efc2d1b94eec2c43a630413b94f7e1c47c3848d2512750b2abd417d48e24cf6442dfb1c17b4dd

  • SSDEEP

    196608:cfU9Zc6BLCAuwqj4FGUY7R7dd5HTK32N5mh:sGhC3+FGUY1J3Pmh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe
    "C:\Users\Admin\AppData\Local\Temp\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\Temp\{EE9D0B1A-4496-4D7A-AAC2-7AE180625208}\.cr\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe
      "C:\Windows\Temp\{EE9D0B1A-4496-4D7A-AAC2-7AE180625208}\.cr\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\Mp3tag.exe
        "C:\Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\Mp3tag.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\ProgramData\Wr_Writer\Mp3tag.exe
          C:\ProgramData\Wr_Writer\Mp3tag.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2776
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\39265dad

    Filesize

    1.1MB

    MD5

    ddc2d89f2e5bb0151476934397658617

    SHA1

    3674393dac4ae72c217685d354a60c25f3837f08

    SHA256

    4f37d61645894af92ba4d68d31b6d84f1ea56834d0f4ccf858525e687cf587fa

    SHA512

    dc62b29a561b879ed90be27209736f77e4111a482b4ebbb70267f6a16f162cada853508b5b1af9d2d7e2966601bd86e357143c515cce7a3b1bfaa9397c0df097

  • C:\Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\Mp3tag.exe

    Filesize

    12.0MB

    MD5

    a7118dffeac3772076f1a39a364d608d

    SHA1

    6b984d9446f23579e154ec47437b9cf820fd6b67

    SHA256

    f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0

    SHA512

    f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890

  • C:\Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\airintake.xlsx

    Filesize

    74KB

    MD5

    946dc224bc5c624516a5a7c198e29f2b

    SHA1

    1e00bef81cd7cbfdfd0e1abc4395cd27838061ca

    SHA256

    840357d9542674dfcd1e70ee824fbdd8c0e138959761534acbbd25553c2290fe

    SHA512

    aaab53abca59c915e0eb109fb2b73226671662e92cde4fd554c93046893a4f0cca52f9ad6b9b829374ab557e851f7de3ba4833a4131f1fc7ee734b84701f4ca0

  • C:\Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\precentor.jpeg

    Filesize

    1002KB

    MD5

    f753ebfcd20924254ca6ef2e450b2d4b

    SHA1

    111b13f7e9aa1322291852a2e4729a22c564a3d4

    SHA256

    72ad670c1d02f919eb49fab3a55cab53dc8fe4c6fff5c14e9f8ab305277a6cce

    SHA512

    48dc896bb3c21fbc70d9e0d458c859361c5cbbc4dc36e4a0c7f79687a264fe29b6d09653e2f3024508b3d3b22b9ae59fe8b7e21d357e7fc5223df2e8535ec2a5

  • \Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\Jurisconsult.dll

    Filesize

    1.1MB

    MD5

    48ad6bd137c6b457d46621118881603e

    SHA1

    b8c177db3fb75c90a6e1d8cb83e8cf6d4ad8992f

    SHA256

    8db2bf1945103d67a73a2d1067d2438bf7da6c40a7e8de99a8433f712a297252

    SHA512

    9c6923f0a35166dc7492beb05ade31eb6e5572afcfb2c006511ab780bdf1cdef1b958057d6fa954873b0228916dbdabdb6daf20a672fc755c94fefd90dff8b14

  • \Windows\Temp\{8BE7ABCE-405D-42CE-812A-493B1F56F761}\.ba\tak_deco_lib.dll

    Filesize

    315KB

    MD5

    48f5aedd31cb66eeec556eaf88962201

    SHA1

    5a415d07aec0d88e9e04699e0dcabc6e81805696

    SHA256

    8170e58e75a0389395499ae7a1e2c9fb6055f548a0ef9322ff944b96f698cbb9

    SHA512

    4855bdd9caa4a9946aa5c9a8033965c2dc55461da083aae1ecfadabd5639e5abbe3ef142a36afd0c79a819636824401fa1902297620dc3ae7a4401dec3888140

  • \Windows\Temp\{EE9D0B1A-4496-4D7A-AAC2-7AE180625208}\.cr\de3fd1673c2ad1ab4b44ee5434a70240ae43722b82a86add6cac1bc22414a34b.exe

    Filesize

    6.9MB

    MD5

    8db744dd49cd575ee3a3a8d80546df82

    SHA1

    433684e875a350927e343c70a1159489201ed2f5

    SHA256

    5f4f1ae19aadbf0f17888bc869a14a6cf98fb52905d089771922674a76e121eb

    SHA512

    7bf08cb19e100e66bf4632cc7ce6b027c2ce6cab88d8c16c6fd404ac86407b5540a434df8004313707147ca1d3fbd6794c4552faeab33830a594b193e5a0023a

  • memory/2532-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2532-44-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2532-46-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2532-45-0x0000000076D90000-0x0000000076F39000-memory.dmp

    Filesize

    1.7MB

  • memory/2728-31-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2728-22-0x000007FEF5C00000-0x000007FEF5D58000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-36-0x000007FEF5AD0000-0x000007FEF5C28000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-39-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2732-37-0x000007FEF5AD0000-0x000007FEF5C28000-memory.dmp

    Filesize

    1.3MB

  • memory/2776-42-0x00000000744E0000-0x0000000074654000-memory.dmp

    Filesize

    1.5MB

  • memory/2776-41-0x0000000076D90000-0x0000000076F39000-memory.dmp

    Filesize

    1.7MB