a6063839433d518acd5f4089118ca50b7348356ca1d6675f4f5bddcd36a2fdd1

Analysis

max time kernel
109s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4232d9627a803e17b38b3a646de9920N.exe
Size

209KB
MD5

f4232d9627a803e17b38b3a646de9920
SHA1

464b36b891be50fad88081d570e43c9dcd9be444
SHA256

a6063839433d518acd5f4089118ca50b7348356ca1d6675f4f5bddcd36a2fdd1
SHA512

92971801c7754ff0e2141d8dd41f65c277585d9d2857d6583e898bdefe766bf28b0fe7fa806736137b4d200184a64ac6e51bf94c4e221124b1412397bc7a82ca
SSDEEP

6144:EhXMue9Nam9u6uwhXEIzPJoZp8QK5bzqwaiOLWVtfXp:EhXMue9cuu6uwZOpyEiZtfp

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4968	f4232d9627a803e17b38b3a646de9920N.exe

Executes dropped EXE 1 IoCs

pid	Process
4968	f4232d9627a803e17b38b3a646de9920N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2288	4480	WerFault.exe	82
2340	4968	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4232d9627a803e17b38b3a646de9920N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4480	f4232d9627a803e17b38b3a646de9920N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4968	f4232d9627a803e17b38b3a646de9920N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4968	4480	f4232d9627a803e17b38b3a646de9920N.exe	90
PID 4480 wrote to memory of 4968	4480	f4232d9627a803e17b38b3a646de9920N.exe	90
PID 4480 wrote to memory of 4968	4480	f4232d9627a803e17b38b3a646de9920N.exe	90

C:\Users\Admin\AppData\Local\Temp\f4232d9627a803e17b38b3a646de9920N.exe
"C:\Users\Admin\AppData\Local\Temp\f4232d9627a803e17b38b3a646de9920N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 396
  2⤵
  - Program crash
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\f4232d9627a803e17b38b3a646de9920N.exe
  C:\Users\Admin\AppData\Local\Temp\f4232d9627a803e17b38b3a646de9920N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 368
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4480 -ip 4480
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4968 -ip 4968
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f4232d9627a803e17b38b3a646de9920N.exe

Filesize
209KB

MD5
73b50996883294e6a25beeeb66b68b33

SHA1
feb8de8e463e5f70fdc58550461c853ff8297739

SHA256
a860b4886b7b31af58dcff3d3e484cd0636d917dc58b13972cf7071979e31252

SHA512
2d237863b5521b305b3d9d0f6e55d60d0f615aa70e942a61f5d18d82132b6ab3db894719d183f3ca0b4e7191427b90c457d244ce2d895f00cd2ce71072c3780b

Download Submit
memory/4480-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4480-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4968-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4968-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4968-13-0x0000000001650000-0x0000000001690000-memory.dmp

Filesize
256KB

Download
memory/4968-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download