d79e2b4abb59a2c52a5375fb5a2658fda3c4913d253c33a183eec718cb6321f2

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

badc53b924ec943a2313a1cd8c323480N.exe
Size

320KB
MD5

badc53b924ec943a2313a1cd8c323480
SHA1

263e5fb8b6a9f411f9304264aae30e8e8342f9d3
SHA256

d79e2b4abb59a2c52a5375fb5a2658fda3c4913d253c33a183eec718cb6321f2
SHA512

e3af09bef4b4bdf766839eb97ca5d9c59749c544d512216e4ac92f30707c8f110c13aed497d7cc05970390f5f6ec07a143eb8402e20964512451be09fae95859
SSDEEP

6144:Z1c++2WfE5w7AcCaBE5AIqfX9aLisM+NeOV40saiigCX:L5+PE5wtBrICX9aLisvNeOVQ5zCX

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3144	badc53b924ec943a2313a1cd8c323480N.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	badc53b924ec943a2313a1cd8c323480N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1888	224	WerFault.exe	83
2916	3144	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	badc53b924ec943a2313a1cd8c323480N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
224	badc53b924ec943a2313a1cd8c323480N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3144	badc53b924ec943a2313a1cd8c323480N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3144	224	badc53b924ec943a2313a1cd8c323480N.exe	91
PID 224 wrote to memory of 3144	224	badc53b924ec943a2313a1cd8c323480N.exe	91
PID 224 wrote to memory of 3144	224	badc53b924ec943a2313a1cd8c323480N.exe	91

C:\Users\Admin\AppData\Local\Temp\badc53b924ec943a2313a1cd8c323480N.exe
"C:\Users\Admin\AppData\Local\Temp\badc53b924ec943a2313a1cd8c323480N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 396
  2⤵
  - Program crash
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\badc53b924ec943a2313a1cd8c323480N.exe
  C:\Users\Admin\AppData\Local\Temp\badc53b924ec943a2313a1cd8c323480N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 364
    3⤵
    - Program crash
    PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 224 -ip 224
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3144 -ip 3144
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\badc53b924ec943a2313a1cd8c323480N.exe

Filesize
320KB

MD5
1bcc49db92cd85121714c1910753b92a

SHA1
e3ddd37dfe9526891889183c66615f2d237c2b95

SHA256
f8c2796ebf158655c9767fc378e01211c5a19a800cbfb88b2d85b34841f7d559

SHA512
84ddee1709a3a20a7e22fba9236ee700d7a4b0c099d0175cd0c48f7ae839dee49d7e23299eaace459a1d18b58f990ff2a3bd9ca22567c2ed9c126625ef0f712d

Download Submit
memory/224-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/224-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3144-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3144-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3144-13-0x00000000014A0000-0x00000000014E2000-memory.dmp

Filesize
264KB

Download
memory/3144-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download