d42491c0f3428248092a7f90416eef036caf9797345b0f59ec87686d3f24a37b

Analysis

max time kernel
100s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iamwp_pro.exe
Size

4.4MB
MD5

341d9c50a8f74b41efecf9bdc3020864
SHA1

218960c8e7240f944c51c70d6866b73dee974938
SHA256

776efd97602dadf08e7aafe91a6a6fba0537ca8b913d6b630d45d631d65d39de
SHA512

1f3b1de344afe8e157cc3262175914ed20677f8cfdc8e06859ac695282942be7868062615ef1a22a50cd7b89c59a9b5a416e80b15dd2ccd420fc049fdf08e538
SSDEEP

98304:AjEldK2hYLmW8AvC998mR5pGtjpqt2EGMZWGmGGfCB:ActJWpC95ctjpCGcNTwCB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1820	iamwp_pro.exe
1820	iamwp_pro.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iamwp_pro.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	iamwp_pro.exe

C:\Users\Admin\AppData\Local\Temp\iamwp_pro.exe
"C:\Users\Admin\AppData\Local\Temp\iamwp_pro.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst1334.tmp\ioSpecial.ini

Filesize
661B

MD5
f9581bb2f44852d3d77f04e4660a8184

SHA1
ba651d30cdf84d3fecea9a93815b3903cb139010

SHA256
30dcba3f11acfa480eb0ee043690dbb47ec6e34f45ec3ce7c4beb6c7c67071b0

SHA512
28b44e13d059438a925835b71a1eba6758572492db5fb4d3c52d7a769976003527025570c55a5f2a0015c6a88240f0b10c74af552e9b839ed0655b6d4920c559

Download Submit
\Users\Admin\AppData\Local\Temp\nst1334.tmp\InstallOptions.dll

Filesize
12KB

MD5
5ec2356b7ad6993d3d4bf31a8dd45473

SHA1
1814b404da2a62b0184f120025262892b00f1fb5

SHA256
e2f63aea3f1ff6d8f075a2a8d386acbd4888c08b01b7cf5ffdc3b1570d2f2109

SHA512
ef1116c190d447f61e7bd5fd8432ba04c1cd24f7d5497d83bb06c5a84219bcc827904db3ea01fae545e8befd925fe68a187ba0e99148dede11e19f9780683be0

Download Submit
\Users\Admin\AppData\Local\Temp\nst1334.tmp\LangDLL.dll

Filesize
5KB

MD5
2c3c8976d729d28478a789217a882291

SHA1
10c18b23fac957419547ef0f8ec3bc1b10e91e79

SHA256
799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef

SHA512
749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213

Download Submit