9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe
Size

5.4MB
MD5

dc7bbb1fdd885298f22b548f9d208cc3
SHA1

1578d0e669543de328613f24f7f862c1c12bbeca
SHA256

9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648
SHA512

c312faad27ec9e8241a230491fb8efcf794ecaf60f56a9fdb6bd76e100396e05877ff5217ee17ef43ebf18f3ab3da152cb38ff9ce8d8784044c9c08528d9f515
SSDEEP

98304:emhd1UryeV4T9hcLqh3iT1GV7wQqZUha5jtSyZIUh:elsPh3gg2QbaZtliU

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2516	3ABF.tmp

Executes dropped EXE 1 IoCs

pid	Process
2516	3ABF.tmp

Loads dropped DLL 2 IoCs

pid	Process
1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe
1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2516	1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe	29
PID 1068 wrote to memory of 2516	1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe	29
PID 1068 wrote to memory of 2516	1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe	29
PID 1068 wrote to memory of 2516	1068	9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe	29

C:\Users\Admin\AppData\Local\Temp\9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe
"C:\Users\Admin\AppData\Local\Temp\9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\3ABF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3ABF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9fccfe027c8666ee1d971633d301817fa55aaf4bed48ade93e89eda6a3d48648.exe B8705BB70FF4C6ADCDD0A081A75E2209E9779FECF1129FB99F3AAFA9AFFD448DA223D307E8B3B0D25EACCE8C9B4B77B1ACC03B70958E9053967CB272FEA8BBF8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3ABF.tmp

Filesize
5.4MB

MD5
217cd5519d691e0005dafe3d5fcfd30c

SHA1
45087911cf2faab811d2d2adaa1afb07453c1b73

SHA256
7b50a8388f3127bd5f8dc567ae6c3c0c8c96480186b5984f5658a0f939db42a9

SHA512
36e657ebad7e3dc56efdb08ad1eab56c30c515f4b40e7b8ded2078bb3f4c747b884ff89264aa76c6f6db826eda838b0aa6bdf0a125741167afb93c6768a74247

Download Submit
memory/1068-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2516-9-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download