9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe
Size

384KB
MD5

8ebc5216cc75a7ad96002738d09952b7
SHA1

61ba9e714f670cc161e6e988c37471002b559213
SHA256

9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565
SHA512

a9d902b95b810b7deeccd7a32e73376235e176a36251e2fd0cb2b91d75c9ef49fbe265eff57ecd7a4a56e690695475c3a4b071ffba7083cd9c0745ac40f3570e
SSDEEP

6144:Yo0HLqKXDLlptlHZigHH2/O377crbc67dANNG8zieDB73sU9wEie+/:bAFLlptl5igH0OLQrbcol8zie973wEE

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2556	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Executes dropped EXE 1 IoCs

pid	Process
2556	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2556	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2556	2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe	31
PID 2528 wrote to memory of 2556	2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe	31
PID 2528 wrote to memory of 2556	2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe	31
PID 2528 wrote to memory of 2556	2528	9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe	31

C:\Users\Admin\AppData\Local\Temp\9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe
"C:\Users\Admin\AppData\Local\Temp\9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe
  C:\Users\Admin\AppData\Local\Temp\9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9ba380ce84fd1117c4f9070e3dce6a2e7e6a68e9c13ee06f9fb845c5c4686565.exe

Filesize
384KB

MD5
e9b9e37664b28e459a3e2be5d15b2452

SHA1
01f32cf1ef5fcb5cc7013b4a1665a961a14f91a0

SHA256
2767dba573d562944e38b9d9402147890bfab069fa29ee51d6a6bb5c239379d3

SHA512
07b9f99dca8084791a0ed347813a0c5474940c25fb733ded91b1873fe51655272676b4bc66452bca4e7d80b56eee2369bd91943661a9e28e0c1681bd506990c0

Download Submit
memory/2528-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-5-0x0000000000130000-0x000000000016E000-memory.dmp

Filesize
248KB

Download
memory/2528-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2556-17-0x0000000000140000-0x000000000017E000-memory.dmp

Filesize
248KB

Download
memory/2556-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2556-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2556-18-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download