c2bbf6fe638c36c001d5d62cc0e49664e446517407a54911db57552adb118aa8

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SuperDeath2.exe
Size 7.3MB
Sample240802-29xcmsyhjd
SHA256 9c027063879df3d477e9092a187c306c7d20eba956cf7517423d8eb2ad5960f2
MD5 391942faa157675018a6d26b6c631011
SHA1 5dd90332e1e1d632fd6e63f9aa2024e667aa5cd5
SHA512 debba49b7fbab85f099e5ff10bd2c75105166f20eb63b058d580e9043f33f272f80096bbce181f71d2476b1fd8059d386c28435a032bfca7210d2cf36f007e4e
SSDEEP 196608:GJXjwzfuuvf08BjSDLpiWA/HTIKUI7RVt:KwzfuqBuDLpiWAfbR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4888-0-0x0000000000400000-0x00000000014D4000-memory.dmp	upx
behavioral2/memory/4888-42-0x0000000000400000-0x00000000014D4000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SuperDeath2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4348	4888	SuperDeath2.exe	84
PID 4888 wrote to memory of 4348	4888	SuperDeath2.exe	84
PID 4888 wrote to memory of 4348	4888	SuperDeath2.exe	84

C:\Users\Admin\AppData\Local\Temp\SuperDeath2.exe
"C:\Users\Admin\AppData\Local\Temp\SuperDeath2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\84FF.tmp\SuperDeath2.cmd""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SuperDeath2.cmd

Path C:\Users\Admin\AppData\Local\Temp\84FF.tmp\SuperDeath2.cmd
Size 7KB
SHA256 e0fa759bb269ad38b6ed2008d4c39cd6a1a90193dfb6de08fda3962891e2e7eb
MD5 0e0804581819d046ebe00f29bdfe77f8
SHA1 a26e8857bb83dc27ed665a91bceb2d70f34a6f5f
SHA512 523841566918822f474074e163ca3f9abdfab83b851b1959866757ea0e4d5b08f2d2dd89e807edf8c51655a119b9c0dfb92fb22a7a8e05783b32e326a7f4dc11
SSDEEP 48:5T25wj5AU2ZzR+8O6zKSR1XR9TApZlzAXSolGDrbwvut3:5T25yazw8jzfXXR9TApZ5WlGnbjt3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4888-0-0x0000000000400000-0x00000000014D4000-memory.dmp

Download

memory/4888-42-0x0000000000400000-0x00000000014D4000-memory.dmp