1ae47c9b5973509ae4e089acc7f7ab71da9ca23885b3eb64ce669151ddec1063

Analysis

max time kernel
101s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b9c06b13388d57e47d85c6195575e0N.exe
Size

192KB
MD5

b5b9c06b13388d57e47d85c6195575e0
SHA1

71815fd19347570310b6b6c43ef0d21e1bf1a2c3
SHA256

1ae47c9b5973509ae4e089acc7f7ab71da9ca23885b3eb64ce669151ddec1063
SHA512

4ae6dc32dc2f095d7e41161f37b03ad9c10ff8f4a247c55dc628360427c857ff34a3e5d286243c76e4cafb2ddd36629f0a632b2ce383cc706063d40683926fd4
SSDEEP

6144:XZVHNYendpsgVLOXXJbIB9ipS14IGRP+Q:XZUeTsgkXXe9iYQ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1988	b5b9c06b13388d57e47d85c6195575e0N.exe

Executes dropped EXE 1 IoCs

pid	Process
1988	b5b9c06b13388d57e47d85c6195575e0N.exe

Loads dropped DLL 1 IoCs

pid	Process
1148	b5b9c06b13388d57e47d85c6195575e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b9c06b13388d57e47d85c6195575e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b9c06b13388d57e47d85c6195575e0N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	b5b9c06b13388d57e47d85c6195575e0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1148	b5b9c06b13388d57e47d85c6195575e0N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1988	b5b9c06b13388d57e47d85c6195575e0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1988	1148	b5b9c06b13388d57e47d85c6195575e0N.exe	29
PID 1148 wrote to memory of 1988	1148	b5b9c06b13388d57e47d85c6195575e0N.exe	29
PID 1148 wrote to memory of 1988	1148	b5b9c06b13388d57e47d85c6195575e0N.exe	29
PID 1148 wrote to memory of 1988	1148	b5b9c06b13388d57e47d85c6195575e0N.exe	29

C:\Users\Admin\AppData\Local\Temp\b5b9c06b13388d57e47d85c6195575e0N.exe
"C:\Users\Admin\AppData\Local\Temp\b5b9c06b13388d57e47d85c6195575e0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\b5b9c06b13388d57e47d85c6195575e0N.exe
  C:\Users\Admin\AppData\Local\Temp\b5b9c06b13388d57e47d85c6195575e0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b5b9c06b13388d57e47d85c6195575e0N.exe

Filesize
192KB

MD5
a9f7a9a23e922f515e877703feec3a3f

SHA1
0cb6602aec085154528282d1b828ff513ce3c7a4

SHA256
34fd251a81f969b6b08027492ba82969a0aa353c161bc718dcb7ae7fc42af212

SHA512
b0e2c3232a2b060558396a55577c742894dbdb37dcf8892145c2cb2dd6d5a92e688a45627bb6d35d237dfb6743774ca6c39c64066b5cb6a8cda3340c8be340e3

Download Submit
memory/1148-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1148-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1988-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1988-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1988-16-0x0000000002BA0000-0x0000000002BDC000-memory.dmp

Filesize
240KB

Download
memory/1988-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download