9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f

Analysis

max time kernel
147s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe
Size

410KB
MD5

88a5899b78368c3063dcd1054b5de0bf
SHA1

36400e1092bddd8edabe2b1bbcae2ffad56af6e8
SHA256

9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f
SHA512

5f09c80b92385fdb976dd09a1e7fffb0c64144f771a9cf702abb11206ad1e72fc0046bb7c6ba3f5efa838acc5765840be9bf4bf5255530b0e9af9bae860bf8f7
SSDEEP

12288:CxIK9V14ImyHYbn4AzWq/Cb43iYPQsA41o:CJEyYb4Az7A41o

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	dxjnne.exe

Loads dropped DLL 2 IoCs

pid	Process
2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe
2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\dxjnne.exe"	dxjnne.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxjnne.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2692	2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe	30
PID 2400 wrote to memory of 2692	2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe	30
PID 2400 wrote to memory of 2692	2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe	30
PID 2400 wrote to memory of 2692	2400	9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe	30

C:\Users\Admin\AppData\Local\Temp\9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe
"C:\Users\Admin\AppData\Local\Temp\9aba273efe8eb471d7173123806a1ff95761d261b36e2df0447e52779c46b03f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\ProgramData\dxjnne.exe
  "C:\ProgramData\dxjnne.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
410KB

MD5
8988d6cb57200572a37890951a3be785

SHA1
5d675a1b060eecb0099a51ba376c03309433e0d0

SHA256
4abcef63c42e44c8b80ce6e1918b91e025d57ce552ae51a378932143af066c96

SHA512
a38cb917f8d8562e9b5a642c20fa51d70e866b87dd4f415ea91ead007d9d5cc18b8faeb70fc063399a1953aee65fc3fc798ee0c20efc8b37e74320996fc0c453

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
\ProgramData\dxjnne.exe

Filesize
260KB

MD5
c53d8781740ab97cb3f9f45e2c668710

SHA1
dfb3111ec6e78126757f1e59d9f60da1b36b507c

SHA256
1c2ea069217363a01a1089bf08ec58ad98c19e42cc35d28a56b01793cf8a1f26

SHA512
3ccae68a68bc022937f60e4e40fddb9498c303e9ac8041202367d127db17dbe2b300c1c793ba9c6f426c642781fac30fa30ea753f361f3c13eb4648871d38c23

Download Submit
memory/2400-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2400-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2400-14-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2692-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2692-531-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads