6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe
Size

3.0MB
MD5

5be84affded6a459de10d6490bc42f25
SHA1

c901557593506294588fe36e85fcb0de94b71778
SHA256

6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9
SHA512

92b7b930aed7b6df7d71d76e404be566f0fccdf507f048cccebfc9d78a14e8086fc05900d88438bcb7527aec96651cbef1c8cec7cccfee71dd1cdbbb741d9ff1
SSDEEP

49152:IARVS4nHwHHzaG0fuEqhfzJ3LKjcniRSVSHo8Vnt9/URlWbEc+YV48GbjMQHaX82:IYPnQHTa3uJ3LKYvVSHoA9/WlWbEyC8X

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4788	6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe
4788	6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4788	6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe
4788	6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe

C:\Users\Admin\AppData\Local\Temp\6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe
"C:\Users\Admin\AppData\Local\Temp\6579f8c3aec9717283fdb6367ec7b17f28858ae704605c76b14198d470bd82b9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\Processes.dll

Filesize
56KB

MD5
cc0bd4f5a79107633084471dbd4af796

SHA1
09dfcf182b1493161dec8044a5234c35ee24c43a

SHA256
3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c

SHA512
67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz85DB.tmp\ioSpecial.ini

Filesize
710B

MD5
32ade988c07eb99b98658a669374a06c

SHA1
c2ee440373a4f8f5a166d123dc67bce49307eb78

SHA256
a12bec2927d2d26421185c9a2362f6cea9b0e630221f4f79e3e129365b33b948

SHA512
3e43171446ba845922b71b9025cf09db0553ace37e58b612caf5744a555c320c0ad97cd0494799e75c5c9876df2c5098f7ee198815dc894be95f0c6f85304937

Download Submit