50f6f71e163bc920a23de81c5ca14399a1712bec31cd6b0ed110fc1a16393295

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conduitinstaller.exe
Size

206KB
MD5

132e1c3a27e824eb6b120226ac368593
SHA1

d99fa9347b3e05ec6a36156323a5d53be8f9f14f
SHA256

cc5d5be9c191a13d58500eb662ebc34f527fa37d6bf0250d5a2bbf4759224642
SHA512

bfc5e207bc73bb53b0a2d8b2ab417f95cc309d09e05fa1ad731e8a0688b9b88c0d5fbc57bf79db8e19b8dc2311c53076e9b21b37e26a7fca72aede3dcb235ac3
SSDEEP

6144:cFJ0sZ1ZdazTH6N0tkl3KKJDvQQ9+AAD6aOR:GzdafO0Md2eaOR

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1984	conduitinstaller.exe
1984	conduitinstaller.exe
1984	conduitinstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conduitinstaller.exe

C:\Users\Admin\AppData\Local\Temp\conduitinstaller.exe
"C:\Users\Admin\AppData\Local\Temp\conduitinstaller.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoF26B.tmp\ConduitInetc.dll

Filesize
471KB

MD5
70e3b20d184751b642b06c5a7855c455

SHA1
89b00dc942e9c4965765acdb08b3e4a392f2af66

SHA256
92e693d3d8be731a66a314e5f15cfad1f4e656f3fee3d32e9e9a736b80be46c1

SHA512
48318557e3eb67379b8a8732457ef07864d4dd7a711f22834f883aaa66dbdab01b490a8928c831690e9aadc1514dfb559731142d7c10afd3e75550ab303a0dd3

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF26B.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1984-10-0x00000000025E0000-0x000000000265C000-memory.dmp

Filesize
496KB

Download