3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe
Size

1.2MB
MD5

56dbc4367833434be158a1a0cebbd1a9
SHA1

9097801ea095f4b4afc15497d9370d3c8a5c913b
SHA256

3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402
SHA512

c216c2ed433994fd1a7759a90dd3464d266014dd5efdc2da30f267ced8d393c17c9f93f425c27a4b76655a1abb34393f0b4fd9d7c8d4efca527c28ce99623a75
SSDEEP

24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8aBsjPz4CXMD:RTvC/MTQYxsWR7aBsjP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe
2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe
2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31
PID 2372 wrote to memory of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31
PID 2372 wrote to memory of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31
PID 2372 wrote to memory of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31
PID 2372 wrote to memory of 2800	2372	3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe	31

C:\Users\Admin\AppData\Local\Temp\3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe
"C:\Users\Admin\AppData\Local\Temp\3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\3848e4539cfa567955ee4cffd6ad22e250afb44728a86550d264dd197ffac402.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Marquand

Filesize
280KB

MD5
b6d48637d1736c2f8f616a9c6f7551a5

SHA1
0808f51721d3421dd2e82d6c6f493635faf65499

SHA256
9ac40f84820e94850d21aa67c374c765a6a0958f9d6397b2b0beef59aedeb6be

SHA512
d43d19b23bdcc3cffe7e4837c3b82ec3da2900356ac0339e1bb1002be77e62429e120da6b1f4f110feca1da863d6124ffd4d62675c316d09fabc8f4353ac0e86

Download Submit
memory/2372-12-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/2800-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2800-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2800-15-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download
memory/2800-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download