1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe
Size

535KB
MD5

8a8a6f83d73a180c15453902aeede774
SHA1

aa1b5e5b42d39c75c835f29b57e9a1a95c52dc2c
SHA256

1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c
SHA512

9166f2ebee3056ab19023faef05eb3b1c719d57123c4aad97b196dd489a16d60408a1ce2c3fc35155341eb6ccad89906806be694c9478abd991712e644122240
SSDEEP

12288:N3IwhAlD0vQhjIhzJEUt6nhAwZ/1vbXFg3zULh5a9NDc:N3Iwh+dlI1JP6hZMq5a91

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3448	pno3z9bycbrexmptrsty.exe
4068	btjppay.exe
716	dzgmxfuszjfn.exe
4852	btjppay.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\aqinopltwralffd\wsvdm7tg	pno3z9bycbrexmptrsty.exe
File created	C:\Windows\aqinopltwralffd\wsvdm7tg	btjppay.exe
File created	C:\Windows\aqinopltwralffd\wsvdm7tg	dzgmxfuszjfn.exe
File created	C:\Windows\aqinopltwralffd\wsvdm7tg	btjppay.exe
File created	C:\Windows\aqinopltwralffd\wsvdm7tg	1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pno3z9bycbrexmptrsty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btjppay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzgmxfuszjfn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4068	btjppay.exe
4068	btjppay.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe
716	dzgmxfuszjfn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3448	4680	1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe	84
PID 4680 wrote to memory of 3448	4680	1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe	84
PID 4680 wrote to memory of 3448	4680	1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe	84
PID 4068 wrote to memory of 716	4068	btjppay.exe	87
PID 4068 wrote to memory of 716	4068	btjppay.exe	87
PID 4068 wrote to memory of 716	4068	btjppay.exe	87
PID 3448 wrote to memory of 4852	3448	pno3z9bycbrexmptrsty.exe	89
PID 3448 wrote to memory of 4852	3448	pno3z9bycbrexmptrsty.exe	89
PID 3448 wrote to memory of 4852	3448	pno3z9bycbrexmptrsty.exe	89

C:\Users\Admin\AppData\Local\Temp\1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe
"C:\Users\Admin\AppData\Local\Temp\1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\aqinopltwralffd\pno3z9bycbrexmptrsty.exe
  "C:\aqinopltwralffd\pno3z9bycbrexmptrsty.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\aqinopltwralffd\btjppay.exe
    "C:\aqinopltwralffd\btjppay.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4852

C:\aqinopltwralffd\btjppay.exe
C:\aqinopltwralffd\btjppay.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4068
- C:\aqinopltwralffd\dzgmxfuszjfn.exe
  qijnxwqtmozv "c:\aqinopltwralffd\btjppay.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\aqinopltwralffd\pno3z9bycbrexmptrsty.exe

Filesize
535KB

MD5
8a8a6f83d73a180c15453902aeede774

SHA1
aa1b5e5b42d39c75c835f29b57e9a1a95c52dc2c

SHA256
1ec56aff8af5d693a9821853d11459be7733aac08e9cc68ffd096dd0d757e47c

SHA512
9166f2ebee3056ab19023faef05eb3b1c719d57123c4aad97b196dd489a16d60408a1ce2c3fc35155341eb6ccad89906806be694c9478abd991712e644122240

Download Submit
C:\aqinopltwralffd\sjfofvv

Filesize
4B

MD5
c9ff5de30d92bbaebe199a23cd75a634

SHA1
77da9518197fd8f44ca455de09ac67801e9adff6

SHA256
baa5deda68890001e96c011c76c9387db261b0e5d753da54046fe2e82b1a7b8a

SHA512
defaf3e46914adf05ce388718e8d4f31b0e7eb33527e04c1eba3eeec650a32d95816c8169f1d3b965cf9611ae7a4fd2b632cad4c135606e3bedfdf193b744a8e

Download Submit
C:\aqinopltwralffd\wsvdm7tg

Filesize
8B

MD5
82e5be2a9009a0d49642f78c824d38b6

SHA1
01b5462fb3d9983c4fcd652d6d459d48a6419deb

SHA256
d7a8386c38f093d2ba2ebc1429e074c2a4cabc520f09fe524f3a70aa4d64ce29

SHA512
5d3c3a8d4892011ac28ed944665625a3ee266fea0f87acb187f465bfb15dbe926f2a92e49bcd302f4693ba6981abb5fe66a0472f3dab3aa1a3d90e2218b598db

Download Submit