48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bass-plugins.exe
Size

2.7MB
MD5

9bd61ba44c6d933a13564cb8fe37bd22
SHA1

8577baa06556c0403500960b8b387e6cbf62054d
SHA256

4e5fde71a3b20b8c15726d06a57513d610a999af558e8daa305e60ed68cc4abb
SHA512

a70ce11a7916954074634ee40d0c9a9b0416830d9e03739dea0251d8f532790183eae8f1c2d15e1c92c214f79e9e1054cf524cdbfc1915a06a3759f3d52976df
SSDEEP

49152:pPzTBtrWHIjhNuCUZ39eRr+ICkgnMCJqZx5Rn6JLJB8OFW6GnOLL6J6kPK:p3B78CUGRSICkgn6x5ls7vGnOLLCi

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2432	bass-plugins.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bass-plugins.exe

C:\Users\Admin\AppData\Local\Temp\bass-plugins.exe
"C:\Users\Admin\AppData\Local\Temp\bass-plugins.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8379.tmp\InstallOptions.dll

Filesize
14KB

MD5
b18dfaded8f6d2380fdfd8f6b6969211

SHA1
969fa0e906240ab1123254feeb833c275626cf76

SHA256
747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58

SHA512
25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8379.tmp\ioSpecial.ini

Filesize
614B

MD5
d7086809889f7f983c62befc93e8794d

SHA1
30b31131664f7effb356d38c61e9d6796ce8e504

SHA256
3a3418de90cc4bfa9fa2a08ce67c0ba4a15d34a430588ba704e1eb347492158d

SHA512
d60c34fc149f21bd98a36de54f4694f130ee18d7511ffb605fa942f1f04f4fc6077b4ebc859a5a4ff5ddf8d6196b40c50ad4f6339a0ceff241673bed9ae24784

Download Submit