2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe
Size

816KB
MD5

465288a2db000ade03801455e0fbec8a
SHA1

8d6340ef0a1bde8dde6ffcc8151548e3dbd92507
SHA256

2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa
SHA512

128af5e0e6435a85a3060b481fd726ac738f69ea0c18eaf3cfcfca122ee3163578c75727e484513531106a8dcaf68af110aede8949c6519a1b933700febb94df
SSDEEP

24576:4Y4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9Y:F3XZynV4oDabuWbDQOcIxJJ9Y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
320	1A0C0E0C120B156F155D15D0A0A160E0F160E.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3104	2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe
320	1A0C0E0C120B156F155D15D0A0A160E0F160E.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A0C0E0C120B156F155D15D0A0A160E0F160E.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 320	3104	2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe	86
PID 3104 wrote to memory of 320	3104	2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe	86
PID 3104 wrote to memory of 320	3104	2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe	86

C:\Users\Admin\AppData\Local\Temp\2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe
"C:\Users\Admin\AppData\Local\Temp\2baa1bf405df8672982d09e921b2eaacb9f4d96d00ee2ca502f3389d53df71aa.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\1A0C0E0C120B156F155D15D0A0A160E0F160E.exe
  C:\Users\Admin\AppData\Local\Temp\1A0C0E0C120B156F155D15D0A0A160E0F160E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1A0C0E0C120B156F155D15D0A0A160E0F160E.exe

Filesize
816KB

MD5
f1c47613a9b1e5dc1fdd17a01350a3e0

SHA1
0f8bacae74b045df6c113987fdd59af0529a0b15

SHA256
065a1dddd95b24e9d0c780507b2d498c489291f6aeea51bea8072b40973f1b3b

SHA512
3dc5136bebb9715b1aafe3f7cefb82aa564cba25c14cec25fa4bc2ec022db00ef06f5450f60962bf2fd39da9fc158c2074e5c0607b0e9b864bc31a49c703816c

Download Submit
memory/320-8-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/320-10-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/320-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3104-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3104-4-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/3104-1-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3104-9-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download