Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30-07-2024 18:06
Static task
static1
Behavioral task
behavioral1
Sample
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe
Resource
win10v2004-20240730-en
General
-
Target
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe
-
Size
25.5MB
-
MD5
f3df1be26cc7cbd8252ab5632b62d740
-
SHA1
3b1f54802b4cb8c02d1eb78fc79f95f91e8e49e4
-
SHA256
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258
-
SHA512
2f9a11ffae6d9f1ed76bf816f28812fcba71f87080b0c92e52bfccb46243118c5803a7e25dd78003ca7d66501bfcdce8ff7c691c63c0038b0d409ca3842dcc89
-
SSDEEP
786432:zRd0l0X/46+nq1rcVqA5Z2bQcLsv0GlYrJF55e2nRk:L5P46+q1QTILMKB5e2nRk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exepid process 1824 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe -
Loads dropped DLL 2 IoCs
Processes:
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exeda5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exepid process 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe 1824 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exeda5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exedescription pid process target process PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe PID 2524 wrote to memory of 1824 2524 da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe"C:\Users\Admin\AppData\Local\Temp\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\Temp\{9B4B6AC3-AE09-417C-AB1A-E9BB90423558}\.cr\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe"C:\Windows\Temp\{9B4B6AC3-AE09-417C-AB1A-E9BB90423558}\.cr\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1882⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5888eb713a0095756252058c9727e088a
SHA1c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA25679434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
SHA5127c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
-
Filesize
675KB
MD5e58bf4439057b22e6db8735be19d61ad
SHA1415e148ecf78754a72de761d88825366aaf7afa1
SHA256e3d3f38fd9a32720db3a65180857497d9064cffe0a54911c96b6138a17199058
SHA5128d3523a12ee82123a17e73e507d42ae3248bd5c0aa697d5a379e61b965781bd83c0c97de41104b494b1f3b42127ab4b48ac9a071d5194a75c2af107016fc8c9c
-
\Windows\Temp\{9B4B6AC3-AE09-417C-AB1A-E9BB90423558}\.cr\da5809df5cb05200b3a528a186f39b7d6186376ce051b0a393f1ddf67c995258.exe
Filesize858KB
MD5504fdaeaa19b2055ffc58d23f830e104
SHA17071c8189d1ecd09173111f9787888723040433f
SHA2568f211f3b8af3a2e6fd4aff1ac27a1ad9cd9737524e016b2e3bfc689dfdad95fb
SHA51201aa983cbddfe38e69f381e8f8e66988273ef453b095012f9c0eeae01d39e32deb0e6fb369363cbb5e387485be33a53ac3ec16d3de1f42bb2cde0cfa05ceb366