d3cf61df231db0180df229b627b01016ffc3f60ad0d84e828ad5c717eacd1718

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0186a27dcc706a0e1258eb44ea28b4a0N.exe
Size

5.4MB
MD5

0186a27dcc706a0e1258eb44ea28b4a0
SHA1

725fb75209483b4bd88bc34d2e16844ce39a8f84
SHA256

d3cf61df231db0180df229b627b01016ffc3f60ad0d84e828ad5c717eacd1718
SHA512

676522a40b95828957fa284af783c9f1973126f801b1026803bda341af1a0fbae5d9758de21fb1631e45899e054c3c9d21be37ff61d9fa7511a531307d20243b
SSDEEP

98304:emhd1Uryej3tPoAVNxZvV7wQqZUha5jtSyZIUh:elDdgq12QbaZtliU

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2980	6162.tmp

Executes dropped EXE 1 IoCs

pid	Process
2980	6162.tmp

Loads dropped DLL 2 IoCs

pid	Process
1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe
1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0186a27dcc706a0e1258eb44ea28b4a0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2980	1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe	30
PID 1316 wrote to memory of 2980	1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe	30
PID 1316 wrote to memory of 2980	1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe	30
PID 1316 wrote to memory of 2980	1316	0186a27dcc706a0e1258eb44ea28b4a0N.exe	30

C:\Users\Admin\AppData\Local\Temp\0186a27dcc706a0e1258eb44ea28b4a0N.exe
"C:\Users\Admin\AppData\Local\Temp\0186a27dcc706a0e1258eb44ea28b4a0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\6162.tmp
  "C:\Users\Admin\AppData\Local\Temp\6162.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0186a27dcc706a0e1258eb44ea28b4a0N.exe FACD93B92ED4770D32D8407ED99262BEB071BD6DFEBBA1D361CA24FB7BE078AF73C8BD922E014C8321F781F31AEFE47A135B2834669636F783BCC9826EB7FEEB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6162.tmp

Filesize
5.4MB

MD5
e6daa727423276fed617d17d2362b164

SHA1
8293c878b518b8c571befe984fba4cbc86e77a6f

SHA256
4b3d03315369a93988fca34805f2df90b8388817b247a030128448759c353cf8

SHA512
0bd724db6e46034bcf3272d2457cdd97c088d19c5710d64d6f5809240c93f0440cc55aa2cc17cb73fe195cefbec79073e6967fb2027a27aadaa0206fa43a7376

Download Submit
memory/1316-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2980-9-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download