9d96a336e5c41ac3d610b59f873f2186286f4d999640953ae48031c0af33794e

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hydra-5.4-win/hydra.exe
Size

180KB
MD5

a372454727710bfdd4950dcfac4c89a4
SHA1

aeddc1b7dd82946ff5b95ce18f7df685bc466354
SHA256

a7eb5c2418100a04c93570fa91dffe320d859540b67005f53b1540641b41f790
SHA512

c3c770118f75f9d5985e6d11107426f11fcdfe5a3f3e2538091c21f9a3b53cc42240e4f2b31268251e571a4abb5da980b8912fdfb5bcc5bfc17f87f84040029d
SSDEEP

3072:mFqQ/UDrOHdks7DNLgo/PmnpurOOrrVXi03YsetlL+xROIzs22+zionA5lei:LIH5PYBroROP2mzei

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hydra.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2688	hydra.exe
Token: SeChangeNotifyPrivilege	2688	hydra.exe
Token: SeRestorePrivilege	2688	hydra.exe
Token: SeChangeNotifyPrivilege	2688	hydra.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2688	2316	hydra.exe	85
PID 2316 wrote to memory of 2688	2316	hydra.exe	85
PID 2316 wrote to memory of 2688	2316	hydra.exe	85

C:\Users\Admin\AppData\Local\Temp\hydra-5.4-win\hydra.exe
"C:\Users\Admin\AppData\Local\Temp\hydra-5.4-win\hydra.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\hydra-5.4-win\hydra.exe
  "C:\Users\Admin\AppData\Local\Temp\hydra-5.4-win\hydra.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-0-0x0000000061000000-0x0000000061180000-memory.dmp

Filesize
1.5MB

Download
memory/2316-1-0x00000000007E0000-0x0000000000960000-memory.dmp

Filesize
1.5MB

Download
memory/2316-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2316-11-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/2316-9-0x0000000063000000-0x000000006310C000-memory.dmp

Filesize
1.0MB

Download
memory/2316-12-0x0000000061000000-0x0000000061180000-memory.dmp

Filesize
1.5MB

Download
memory/2688-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2688-6-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/2688-7-0x0000000061000000-0x0000000061180000-memory.dmp

Filesize
1.5MB

Download
memory/2688-5-0x0000000061000000-0x0000000061180000-memory.dmp

Filesize
1.5MB

Download
memory/2688-3-0x0000000063000000-0x000000006310C000-memory.dmp

Filesize
1.0MB

Download