cc1ec1750f76c2cbeeb9b8e01815fd5f413f7b9f04b0568ab102c3e240100a48

Analysis

max time kernel
119s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6436163200980ad752cde1484e0fe920N.exe
Size

511KB
MD5

6436163200980ad752cde1484e0fe920
SHA1

179315e5c3d09fcc6dc81bc2a483866300822bc7
SHA256

cc1ec1750f76c2cbeeb9b8e01815fd5f413f7b9f04b0568ab102c3e240100a48
SHA512

1cdb24f0a216c6722a642f6dabe43521697ea87b57b1200658b1da8dff66eb34bb74ad534cff28d95b312c6b866761b126ac69ff568f9c06b0c7bdbb6f2c240e
SSDEEP

12288:H1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0HKUjDsQB3GIbS9thh+/hhhah1:H1/aGLDCM4D8ayGMbp3GIbS9thh+/hhU

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4892	patpe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\patpe.exe"	patpe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6436163200980ad752cde1484e0fe920N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patpe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4892	468	6436163200980ad752cde1484e0fe920N.exe	83
PID 468 wrote to memory of 4892	468	6436163200980ad752cde1484e0fe920N.exe	83
PID 468 wrote to memory of 4892	468	6436163200980ad752cde1484e0fe920N.exe	83

C:\Users\Admin\AppData\Local\Temp\6436163200980ad752cde1484e0fe920N.exe
"C:\Users\Admin\AppData\Local\Temp\6436163200980ad752cde1484e0fe920N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468
- C:\ProgramData\patpe.exe
  "C:\ProgramData\patpe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
511KB

MD5
98c4aa51301898a00c8405b2b7f9bfc9

SHA1
c45c09a0dbd6529c4099099ac56052c83caf42b7

SHA256
e3c75d22ce75b57be8e73e07b50b917fbeca16b826dcf901088026f7523b4b4e

SHA512
632a854bb95457415dabf39d930f206c0636fd723105568c9cccb3b97e9f5586c5714f1c15c14aa1f4442873026f63c37c0395104a17213c861981c2e34a09e9

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
255KB

MD5
f351898b5ba2d709e4d73d3160071029

SHA1
5bddf9621650635913bea3f15cb0f7108a09079e

SHA256
22972cfc5b13ea8cedef1adca83358f89fea716b3e775bd70553ed44ef04e668

SHA512
c9c680f93577ca853d9db3d9b84d16a43c1986c95d3bfc4ff3bbbafaa585cf6ee6ada6da6e86cea529e817f39e4e98d78c1ad99069aa417514ef5bab735ccf88

Download Submit
C:\ProgramData\patpe.exe

Filesize
256KB

MD5
d653528ebfe916888e134cdd1113478c

SHA1
f8312ac83ed47a35ccf41328f699a2cebdec855c

SHA256
bc1d306f72026c7966aa891452512c67a979d81347edec4aeeec019c6f659deb

SHA512
cc313831d6f5448489efe03d8ad5e3474b2f8cc1ef3f768d47be4b25627ca5de306234d4d59514545b85a9821b80c80ed5a644c3f23269bfb8b8e8a31c619c2c

Download Submit
memory/468-8-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4892-128-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads