5efc0ccfd63995950342dd908655951f56fb5a29f9cf2d7b6d1d90b58688f9b1

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7ff71f2a15a8c5b889a55c909694b20N.exe
Size

35KB
MD5

c7ff71f2a15a8c5b889a55c909694b20
SHA1

cceb3fb1930aa5425abc1f36e0ef02575bc9ad3f
SHA256

5efc0ccfd63995950342dd908655951f56fb5a29f9cf2d7b6d1d90b58688f9b1
SHA512

e93f33020d0b029ba319e38b8cdcab4dc6f4096e8358140768288d8939c7fb2e1a3623ea0d6e169d5ee73c2a806988136a604abf1052d2208bc80b177fe8984b
SSDEEP

768:1aK6RMHQF0Ta640zl2d6EIHkKRBHC+8ySbBKmsOsh4wm:1wKHQaTaT028EIHkQBHC+8ySbBKmsdSt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5088	slabtak.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7ff71f2a15a8c5b889a55c909694b20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	slabtak.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 5088	4392	c7ff71f2a15a8c5b889a55c909694b20N.exe	86
PID 4392 wrote to memory of 5088	4392	c7ff71f2a15a8c5b889a55c909694b20N.exe	86
PID 4392 wrote to memory of 5088	4392	c7ff71f2a15a8c5b889a55c909694b20N.exe	86

C:\Users\Admin\AppData\Local\Temp\c7ff71f2a15a8c5b889a55c909694b20N.exe
"C:\Users\Admin\AppData\Local\Temp\c7ff71f2a15a8c5b889a55c909694b20N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\slabtak.exe
  C:\Users\Admin\AppData\Local\Temp\slabtak.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\slabtak.exe

Filesize
35KB

MD5
a255c342b80298730d8dd16dde699760

SHA1
0230f92797bdea8c42103c6511827160dd1f0182

SHA256
71b70501e265149422f7ceb57586b599a04270cbd6fafe323b34cafefc0b4364

SHA512
8199fb6e84b2d38e982884c7c26c618cc7db2c30768a59e6f1e3616a734829de46d9acb1a049a3bac08238d7a2098d048ccfab423317be8cbd1cc2e7565df678

Download Submit
memory/4392-0-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/5088-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download