063e09c22883b025e2e8bb6ec41cbf295c199bdcf243e2656dc6dbfd4fc5a00c

Analysis

max time kernel
135s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A.N.exe
Size 1.3MB
Sample240729-2c3hdsyang
SHA256 063e09c22883b025e2e8bb6ec41cbf295c199bdcf243e2656dc6dbfd4fc5a00c
MD5 72b734e502c86cbe3730a2a601079fc0
SHA1 e248d97c0b59bc287c9d2c91ecbbbd52df3419c3
SHA512 44625c82aae8571727440e6926dfe2f0320964e98d8a0b03dc4764fb3b803e3370e1927dce180621532308a5875a5001f1decb1210e75533be2d4cee846369d9
SSDEEP 24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aAhQ/A132oYunsfI8/nG:hTvC/MTQYxsWR7aA2/+m7qsl/n
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 2700	1172	A.N.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.N.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1172	A.N.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1172	A.N.exe
1172	A.N.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1172	A.N.exe
1172	A.N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2700	1172	A.N.exe	87
PID 1172 wrote to memory of 2700	1172	A.N.exe	87
PID 1172 wrote to memory of 2700	1172	A.N.exe	87
PID 1172 wrote to memory of 2700	1172	A.N.exe	87

C:\Users\Admin\AppData\Local\Temp\A.N.exe
"C:\Users\Admin\AppData\Local\Temp\A.N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\A.N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autB7D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\autB7D6.tmp
Size 375KB
SHA256 585ed849cf4ed274f10d934499b6805e51365dff22d575ed26c8edce545b2380
MD5 1993299080b40767e6bcd534a2579b63
SHA1 7e79c428b84d4145a78b7e78f2f2b44b6e21a34e
SHA512 bb4f202c47c15a7eba71904db33c79d0bd3919b2151eb5f4363f9b5877b2d06b8867e48e792f17a6a622a7d76b961d59734b4e955b5414bdeb723487f5924069
SSDEEP 6144:BtTJPDWOZ69zLKsANARjZLN0UaBALEBesrGEF/cLG491+8LR2tC:B9JPDWOw9vKsQ2FLvCFiES39g8LiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1172-13-0x0000000001090000-0x0000000001094000-memory.dmp

Download

memory/2700-14-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2700-17-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2700-18-0x0000000003600000-0x000000000394A000-memory.dmp

Download

memory/2700-19-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2700-20-0x0000000000400000-0x0000000000462000-memory.dmp

Download