d42491c0f3428248092a7f90416eef036caf9797345b0f59ec87686d3f24a37b

Analysis

max time kernel
136s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

iamwp_pro.exe
Size

4.4MB
MD5

341d9c50a8f74b41efecf9bdc3020864
SHA1

218960c8e7240f944c51c70d6866b73dee974938
SHA256

776efd97602dadf08e7aafe91a6a6fba0537ca8b913d6b630d45d631d65d39de
SHA512

1f3b1de344afe8e157cc3262175914ed20677f8cfdc8e06859ac695282942be7868062615ef1a22a50cd7b89c59a9b5a416e80b15dd2ccd420fc049fdf08e538
SSDEEP

98304:AjEldK2hYLmW8AvC998mR5pGtjpqt2EGMZWGmGGfCB:ActJWpC95ctjpCGcNTwCB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4776	iamwp_pro.exe
4776	iamwp_pro.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iamwp_pro.exe

C:\Users\Admin\AppData\Local\Temp\iamwp_pro.exe
"C:\Users\Admin\AppData\Local\Temp\iamwp_pro.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nstA113.tmp\InstallOptions.dll

Filesize
12KB

MD5
5ec2356b7ad6993d3d4bf31a8dd45473

SHA1
1814b404da2a62b0184f120025262892b00f1fb5

SHA256
e2f63aea3f1ff6d8f075a2a8d386acbd4888c08b01b7cf5ffdc3b1570d2f2109

SHA512
ef1116c190d447f61e7bd5fd8432ba04c1cd24f7d5497d83bb06c5a84219bcc827904db3ea01fae545e8befd925fe68a187ba0e99148dede11e19f9780683be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA113.tmp\LangDLL.dll

Filesize
5KB

MD5
2c3c8976d729d28478a789217a882291

SHA1
10c18b23fac957419547ef0f8ec3bc1b10e91e79

SHA256
799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef

SHA512
749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA113.tmp\ioSpecial.ini

Filesize
661B

MD5
cb4ba6014f0eca89a8fcf58b214e5bb8

SHA1
de5928a97b3d90449dbd9dcce9bc20fccb7ad32e

SHA256
83957d7a086e83bb35ec6b73fb4cde64bf36e1d3ce4653ab328a1e182533c32b

SHA512
6e0d6437698ba8677c3dfb506785def1b3cfd0cdbd0974f488c5ed0b082d7d47cf6f615cf26b6c135063001722eb94caabfaa651e0b8dc71a5a29597320d42cc

Download Submit