a50575b36489d8366f7d72df5bae30a17ae7872220e0685ecdb55bdea6a1b2ae

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/smartinstallAllinOne.exe
Size

202KB
MD5

082c78654828352b43e7818ae272c826
SHA1

b1a6c498bc0ed6776e84345e30df83a7c0db425a
SHA256

981c92d332c0c69c89b2c8d944f8a773823ec91228deb4447898773df7822bc5
SHA512

eb6ef52b589d0b948992c23781516745d6417a96bfc85fab2654b3dca18d6a61e4083c04afd8bb887ce0f721f197cd1fc1738af7a65dd1ad77ddd86597f73ac1
SSDEEP

6144:h40JDvFeKBw8v92A7BBNC0kz/ifYxUxBE1T3N:71Bv/NwbWTC3N

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2304	GLB33BD.tmp

Loads dropped DLL 2 IoCs

pid	Process
3048	smartinstallAllinOne.exe
2304	GLB33BD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLB33BD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smartinstallAllinOne.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29
PID 3048 wrote to memory of 2304	3048	smartinstallAllinOne.exe	29

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\smartinstallAllinOne.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\smartinstallAllinOne.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\GLB33BD.tmp
  C:\Users\Admin\AppData\Local\Temp\GLB33BD.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$PLUGI~1\SMARTI~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLB33BD.tmp

Filesize
70KB

MD5
91c551a92e678f977821ea9c1079f984

SHA1
f3243b6ff7ea118a178f301a9bd3d0dc1a18741d

SHA256
9bb92f379e5c313528112a53488ca106f1da97c88082f124fcdfbdb392833db6

SHA512
f584b1094ab4ce1db7976706aca2c89601c80a106d86eeaf2b2b4a4059ff54e0c94817bd5ddd3bb21a6584878efad8262b9a1d7961a80035785240995854e491

Download Submit
\Users\Admin\AppData\Local\Temp\GLC33EC.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit