419f5936bb164413541c97966c9074e7f20e49949f005f94c7800784245c6ffd

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

405KB
MD5

82445b614a19b6dd8b0cc300df368fb5
SHA1

00bbc0ce4c476a3808fa94257c8b19d72b686c61
SHA256

419f5936bb164413541c97966c9074e7f20e49949f005f94c7800784245c6ffd
SHA512

05c5d04e1c2d0cd32ee0a3c284466d23156e2fdb64de1d54b15e73d53e2ec2012340c7f56b7e2e24bae01c01fcbeee7698b62e5807f7f6c50191be99f8d53279
SSDEEP

6144:NtXZXfpALF2QGmlcc+Ag3IDFe2hySyChuHwEsLPXmvpW+Qm0N85WOX/i1UBml:NtjALF2QGm6cWEDhy1WyQL/qpWU56Ucl

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1956	sample.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1956	sample.exe
2672	sample.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2672	1956	sample.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\logorrheic.ini	sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1956	sample.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2672	1956	sample.exe	31
PID 1956 wrote to memory of 2672	1956	sample.exe	31
PID 1956 wrote to memory of 2672	1956	sample.exe	31
PID 1956 wrote to memory of 2672	1956	sample.exe	31
PID 1956 wrote to memory of 2672	1956	sample.exe	31
PID 1956 wrote to memory of 2672	1956	sample.exe	31

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\sample.exe
  "C:\Users\Admin\AppData\Local\Temp\sample.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsj9649.tmp\System.dll

Filesize
11KB

MD5
7399323923e3946fe9140132ac388132

SHA1
728257d06c452449b1241769b459f091aabcffc5

SHA256
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

SHA512
d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

Download Submit
memory/1956-13-0x00000000770E0000-0x0000000077289000-memory.dmp

Filesize
1.7MB

Download
memory/1956-12-0x00000000770E1000-0x00000000771E2000-memory.dmp

Filesize
1.0MB

Download
memory/2672-14-0x00000000770E0000-0x0000000077289000-memory.dmp

Filesize
1.7MB

Download
memory/2672-15-0x0000000000470000-0x00000000014D2000-memory.dmp

Filesize
16.4MB

Download