be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005

Analysis

max time kernel
93s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
Size 590KB
Sample240817-b2zvpatapn
SHA256 be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005
MD5 86f6d5340660600317dc3481647ebe32
SHA1 c3ae7e6c0f47a1b9b434bcf315f638a5a1bf8345
SHA512 01c9e08555bfdc6ab9f9bc908fdf52fda9b23d78862600f18c0ce0c0e77f6b6c89fe008850b9181a90e873fa5f104975b58be8624dbfdd8fc56f9af2b8936dd6
SSDEEP 6144:sxwgiJ4hlMGom0ymbOdwiJMAIzuAeoeqZipjE3YfBxYbZI0Ti:eS4vNoL7L5A1uZipjEIfBxP0Ti
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	2288	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1980	2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe	30
PID 2288 wrote to memory of 1980	2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe	30
PID 2288 wrote to memory of 1980	2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe	30
PID 2288 wrote to memory of 1980	2288	be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe	30

C:\Users\Admin\AppData\Local\Temp\be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe
"C:\Users\Admin\AppData\Local\Temp\be097d80233fd20b30cdacd88fbb4baef2ceabc7e45daead33b675ff4dcc4005.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 388
  2⤵
  - Program crash
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

strikkernes.lnk

Path C:\Users\Admin\strikkernes.lnk
Size 912B
SHA256 ab6c65215414129badea3d20a0a2dbdc6c519d01a3255a03048c83d5d9532b2d
MD5 379612627e148ec9ac6bffb58c2e89b8
SHA1 25c734c38f7420fddf7386b270b6c3564c8429b0
SHA512 52666d693cd6ccee8797c94a11281b38f3ab5fe212bd4f2004714f58f69856711b9c13795ae4735567e428126703bb0d23482016474b8caef58cd3f1dc93895d
MD5 SHA1 SHA512

Submit Download

LangDLL.dll

Path \Users\Admin\AppData\Local\Temp\nsz98B8.tmp\LangDLL.dll
Size 5KB
SHA256 92cb3b3a7280246743543325d3fe9a7d72c63227f9540d25d5ef27b2ce8856b4
MD5 af4324802813a5a897db2167fc10e291
SHA1 916bd47457dcb4247743626e86492436b77bebf8
SHA512 cb3e07c4558049634078808bd419860c6e2855a02bba79541cea80873fe6db58cf667a27c111521df09ef30f92c149736092c473fde28bbb5974be6d7ddab83c
SSDEEP 48:qcjtDVP10LgQL8QRU8IlmWm7WmnuWK8hSemoMqG5QEv8sF9UwofMU:xVPFQIqlemWm7WmTaehG+Ekq
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsz98B8.tmp\System.dll
Size 12KB
SHA256 1624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
MD5 6c38da8922cc37b4bbb77de4a63ad843
SHA1 4e0533fd11df8bddbd543ed58df7b6060d9f4631
SHA512 ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430
SSDEEP 192:wA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:QR7SrtTv53tdtTgwF4SQbGPX36g9Mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2288-41-0x00000000033C0000-0x0000000005B55000-memory.dmp

Download

memory/2288-42-0x00000000033C0000-0x0000000005B55000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads