e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe
Size

3.5MB
MD5

ef4c4b6fe79c62c92f384f83170cd835
SHA1

612af3a88b900de2e42dc2d016ab1c9f794c4731
SHA256

e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962
SHA512

14344d4ec384b51eae540c2532b787ec2f2ac06d62e632877841b90e2de734dc43c2cdab24c092756bd92df8041ade081993994a413525fd7fd18189a142308d
SSDEEP

49152:jBuZrEUUOzdZU4ziikuUM7Up6X6r5pW/fkyvwI+PQ5TvxB5FQ855DdN7POGjG:lkLvSiiAUCA6UpWU9I+2JBX55ljG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3980	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3980	2168	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe	86
PID 2168 wrote to memory of 3980	2168	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe	86
PID 2168 wrote to memory of 3980	2168	e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe	86

C:\Users\Admin\AppData\Local\Temp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe
"C:\Users\Admin\AppData\Local\Temp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\is-NVRCN.tmp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NVRCN.tmp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.tmp" /SL5="$80050,2888097,832512,C:\Users\Admin\AppData\Local\Temp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-NVRCN.tmp\e1709fff6ae3ff5161ea14d930a0769facb6d7ec258cf599505c2c896f58a962.tmp

Filesize
3.0MB

MD5
7e620e062502ac4cb9cb529ca5445965

SHA1
fbb15489abc6d7200c0759263d84c2e86f9bece7

SHA256
5a09f3ce84567676ed43b4ae393f808e777f4388281ec11840b377b330332579

SHA512
78d414e9c4fe15d61ddccc2ba2cbb789248c7a63503dc431ac62339acbc91cb25fd90aad95a59a116e197a8000600e672ae585a6b34d2dd234be4fff17e1087e

Download Submit
memory/2168-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2168-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2168-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3980-6-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/3980-9-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download