f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
Size

6.7MB
MD5

68bfb549ad759c6d95f5b224c845ae26
SHA1

596e1cbcc8248b66598a9df7e4ddc89d1001c528
SHA256

f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a
SHA512

f1a36e31e9f2f717abbc060477a522486f8200298481737394916c667c83ec03983a1d755204514819364f8a441687335d04d969b39510d35873e816aa27c692
SSDEEP

196608:LIrS5A5nMK9G9D+QP3aDG5GGnOk1CPwDv3uF0jaRCiBrqW4D203ta:LIrSad9G9D+QiDfGnOk1CPwDv3uFwan7

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
1732	f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe

C:\Users\Admin\AppData\Local\Temp\f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe
"C:\Users\Admin\AppData\Local\Temp\f99525c271dc1d03aac87eba7cb3f166c6574d3ef159f7f45fa5e1bc0fcb4b9a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll

Filesize
1.7MB

MD5
e9888362828d6b6f6e13e6cfa5a36419

SHA1
f097e4cc95f40012af1143ff345ba39180dfd32b

SHA256
37cc65da464443f780ba555ed3c86f5f1003ccbe790f85f3a612c62741c9fa92

SHA512
175487a2d5abd4c16054541e9954d909092107e254dc49d5a48fda1b7182d6cc6618d338855cd67432a85d57bf1224baeed3822a2f7b6442aca2a0ed9a124241

Download Submit
\Users\Admin\AppData\Local\Temp\libssl-1_1.dll

Filesize
353KB

MD5
2e13693945236594078a2e7c4fd029be

SHA1
b06f79529790acefedc4019d905b2a31cdb5d3e9

SHA256
e9cedb410df5a475a08b2f17ec5ea5615d02ff4f1a1e045f53053a73da9a2474

SHA512
127f3d276b7a53d724db4f316454df5436e68631089eb2e0eec706d49bf373f76619de1f089f15ed0a89e78d9baa8364145afee4242e5804803d2bc8487ed4d8

Download Submit
memory/1732-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1732-7-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1732-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1732-18-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1732-17-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download