a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe
Size

73KB
MD5

6ec0a874ec5e06904b42b9e85c219c6d
SHA1

cd2c8dadc6e0f6afd7a035d8b3d9fb4d167f8742
SHA256

a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69
SHA512

84204fe30ed7395e040b931eeac82c0eb15e0810d8b4aec9aa9a29dcb864dc76ea0e2d23aed223971fb739725fd1bb54701eadad3d9b774fd133d6a71e734425
SSDEEP

1536:hbzMXkZKK5QPqfhVWbdsmA+RjPFLC+e5hzQ0ZGUGf2g:hUXkkNPqfcxA+HFshMOg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3056	cmd.exe
3056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3056	2360	a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe	32
PID 2360 wrote to memory of 3056	2360	a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe	32
PID 2360 wrote to memory of 3056	2360	a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe	32
PID 2360 wrote to memory of 3056	2360	a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe	32
PID 3056 wrote to memory of 3052	3056	cmd.exe	33
PID 3056 wrote to memory of 3052	3056	cmd.exe	33
PID 3056 wrote to memory of 3052	3056	cmd.exe	33
PID 3056 wrote to memory of 3052	3056	cmd.exe	33
PID 3052 wrote to memory of 2348	3052	[email protected]	34
PID 3052 wrote to memory of 2348	3052	[email protected]	34
PID 3052 wrote to memory of 2348	3052	[email protected]	34
PID 3052 wrote to memory of 2348	3052	[email protected]	34

C:\Users\Admin\AppData\Local\Temp\a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe
"C:\Users\Admin\AppData\Local\Temp\a1342491b911f40726ff232f367fcdd1c20b374546006ef652422fafae771f69.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
e409bcda0511dad3e9c092ec3a6b2af7

SHA1
e9f625e8ccb6bc03bc6b48b8e84c02ee36a9727b

SHA256
4f45e04f187c94c8f839d53b76038b834da261959b544f4299eeb77de79e88ea

SHA512
6c9ab48e23d7c19c68f0f574abbe044426e9f29f6ea2d8b91837cda999d481cde8addd09a58ae887edea96fe955815da1d4172556652da652ffd652338e516b8

Download Submit
memory/2360-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3052-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download