0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe
Size

3.6MB
MD5

a0a8197b1721b0438150f5ed14a8948b
SHA1

cc238d54e5fb0d341dbebef5d9550c66399185cc
SHA256

0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51
SHA512

58567e3725327cd90d47d17f06cea507feb27d54b45398f36e2c53ab0648d284f575d213daca37d61ef67cffbd64f8ccf78481c3289cb8428db2a697f4fbc9e4
SSDEEP

98304:1iTy7HOC4ejiRsCe9q3HbCPDCsqua0VUpA3U:1BbO9ejMaq3uPDqJpA3U

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1604	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1604	5072	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe	84
PID 5072 wrote to memory of 1604	5072	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe	84
PID 5072 wrote to memory of 1604	5072	0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe	84

C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe
"C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\is-6TI2J.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6TI2J.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp" /SL5="$70292,2907832,781824,C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-6TI2J.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp

Filesize
3.0MB

MD5
e5d5fe01f4c160c87767b17b51d4b0c7

SHA1
c4352a64d4d751d2d78ce7ab8e44372cecfb2fc1

SHA256
08e3f17c3fbec1485463f9953d47c47142a7f3aae8b5196d8b8aaf4c92a54ab8

SHA512
ef5adc9ada82a6753194d407ccafd15e2a96458c0ab180f198badfcdafdd677a126b4c0b0b2963848ed66fccddee054f4e14e76ea5e503a617af7c6a06c72bac

Download Submit
memory/1604-6-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/1604-10-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/5072-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/5072-2-0x0000000000401000-0x00000000004A8000-memory.dmp

Filesize
668KB

Download
memory/5072-8-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download