3d30d04d774f3b23290480ef81b3a21f2852001a2a136a4db06b4750193bcdc5

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5b842380854917417d1555d30ecc930N.exe
Size

71KB
MD5

d5b842380854917417d1555d30ecc930
SHA1

0702dcb119eb835dedeb35fcd58d783a252fe50e
SHA256

3d30d04d774f3b23290480ef81b3a21f2852001a2a136a4db06b4750193bcdc5
SHA512

df5ebecb4a5965e393dc3f0b050c910ae1acb90c80ffca42d9ecbad085eacd2bc3f23fcbd2d84b8d45b3a301b15abd7ea809817db120ddb2ab42e1c00ed82d20
SSDEEP

1536:1hyToPledgGkglSt9yzkwUk6Nr5kEHIwAmj4M:ghgRglStYzkrJNFkEH7jr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	odpuvoak-imum.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\odpuvoak-imum.exe	d5b842380854917417d1555d30ecc930N.exe
File created	C:\Windows\SysWOW64\odpuvoak-imum.exe	d5b842380854917417d1555d30ecc930N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5b842380854917417d1555d30ecc930N.exe

C:\Users\Admin\AppData\Local\Temp\d5b842380854917417d1555d30ecc930N.exe
"C:\Users\Admin\AppData\Local\Temp\d5b842380854917417d1555d30ecc930N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3180
- C:\Windows\SysWOW64\odpuvoak-imum.exe
  "C:\Windows\SysWOW64\odpuvoak-imum.exe"
  2⤵
  - Executes dropped EXE
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\odpuvoak-imum.exe

Filesize
67KB

MD5
da939f4adc6a4f6fc65d92f39335286f

SHA1
d3adfed23d1acf0f512e9f1025524297ec857396

SHA256
7adb61bf1a4905df5b0f41c77cbca174fee0d71a83add83b2cc5f579101c0319

SHA512
62a772b6f811be23650637017141090d439334c1be6b66a990d306ccb2a53b887f0989bb2f5d16967cb966c17f0b0c42567bb34c68ada2c42de393f770ef8106

Download Submit
memory/3180-1-0x0000000077662000-0x0000000077663000-memory.dmp

Filesize
4KB

Download
memory/3180-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download