98c722526980af2b4915f7b22cb1aeb51a57b5a517642dae952fcc49f34a2628

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af5a206750a5fb8bb181e6733f2450a0N.exe
Size

1.2MB
MD5

af5a206750a5fb8bb181e6733f2450a0
SHA1

73f8fede00769661fae87e555c7a289a76370254
SHA256

98c722526980af2b4915f7b22cb1aeb51a57b5a517642dae952fcc49f34a2628
SHA512

34ba5c8081a6de7d36e394c4fb0abd1284238bbb69a937cc092e3cbcb00a7508a505a0ddd19c907c4a78a8ff4cda01e28d9e7637034d945c6c60d3fc9510c3e6
SSDEEP

24576:Y2U35IgezjL9kjRuTgmbd3XXRlLWa/ZSba/JXUZkjdC77Lv+f6T8YnGoh:Y2UgLWjRuzbd3HrLWgkgGuj4bNnGoh

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2612	af5a206750a5fb8bb181e6733f2450a0N.exe

Executes dropped EXE 1 IoCs

pid	Process
2612	af5a206750a5fb8bb181e6733f2450a0N.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	af5a206750a5fb8bb181e6733f2450a0N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
3	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af5a206750a5fb8bb181e6733f2450a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2612	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2612	af5a206750a5fb8bb181e6733f2450a0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2612	2512	af5a206750a5fb8bb181e6733f2450a0N.exe	31
PID 2512 wrote to memory of 2612	2512	af5a206750a5fb8bb181e6733f2450a0N.exe	31
PID 2512 wrote to memory of 2612	2512	af5a206750a5fb8bb181e6733f2450a0N.exe	31
PID 2512 wrote to memory of 2612	2512	af5a206750a5fb8bb181e6733f2450a0N.exe	31

C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
"C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
  C:\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\af5a206750a5fb8bb181e6733f2450a0N.exe

Filesize
1.2MB

MD5
004b69c86ce9be7cb3bb1ed572d19145

SHA1
d93ffc1333cd2a8ad44f332e8da666eaeba0dff3

SHA256
4b486f043229ff2299ccf3dc5d7a133b5ab44ce216884a083d252e4352feacab

SHA512
cd0ec1ef6c9988a646a1753b85ac2b068890abcd0588d5e8467158eefb0be75617bdf9fea063d6949d23b725d1e21836e6f93a2d213738154dfbf47357eeba31

Download Submit
memory/2512-0-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2512-9-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2512-7-0x00000000030A0000-0x00000000031BA000-memory.dmp

Filesize
1.1MB

Download
memory/2612-10-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2612-17-0x0000000002F40000-0x000000000305A000-memory.dmp

Filesize
1.1MB

Download
memory/2612-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2612-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2612-39-0x000000000FF30000-0x000000000FFD3000-memory.dmp

Filesize
652KB

Download
memory/2612-40-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download