cf20799ee3c98e3ded12a36d4f2c4d5750f3531870a9e9f00f812b12fa9aa193

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04ee7f87cd09f02c961c6c99c9dc9b30N.exe
Size

2.9MB
MD5

04ee7f87cd09f02c961c6c99c9dc9b30
SHA1

2a82967388990720b990322388abc324409c956e
SHA256

cf20799ee3c98e3ded12a36d4f2c4d5750f3531870a9e9f00f812b12fa9aa193
SHA512

4521c295f9f04b18bd7dce95aed46f228b7f6f60eb796069c6953842ac33ff3a2c5b2a33c857707ec481d58ae55aaf930b8e1634b4b3f15f58431a7105c8efd8
SSDEEP

49152:vXA4KTEh+bP8thNggQERTbExL5ISJSK6naPsD0gKQhYhgQbExL5Imn2hi:vXAVoh+bP8tPQERTQQSJSKPF7WSQQmn7

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	04ee7f87cd09f02c961c6c99c9dc9b30N.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	04ee7f87cd09f02c961c6c99c9dc9b30N.exe

Loads dropped DLL 1 IoCs

pid	Process
2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04ee7f87cd09f02c961c6c99c9dc9b30N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2520	2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe	30
PID 2056 wrote to memory of 2520	2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe	30
PID 2056 wrote to memory of 2520	2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe	30
PID 2056 wrote to memory of 2520	2056	04ee7f87cd09f02c961c6c99c9dc9b30N.exe	30

C:\Users\Admin\AppData\Local\Temp\04ee7f87cd09f02c961c6c99c9dc9b30N.exe
"C:\Users\Admin\AppData\Local\Temp\04ee7f87cd09f02c961c6c99c9dc9b30N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\04ee7f87cd09f02c961c6c99c9dc9b30N.exe
  C:\Users\Admin\AppData\Local\Temp\04ee7f87cd09f02c961c6c99c9dc9b30N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\04ee7f87cd09f02c961c6c99c9dc9b30N.exe

Filesize
2.9MB

MD5
ce0a40dee39d49417997d6477ff788ee

SHA1
f523655aa6263e2c93c2f16942861b9f7092577a

SHA256
ad6a68f8c1db7fcfdd711ec88be1b7cc2a3e001a09bd8a2336694016365aed8a

SHA512
0bfbfd539597275dca0c879efab443cd2fcf8717364f0fb5dabf06a303e1ff5f649c173644091c19edf701854f5feb1f0d2058669a571d6f00f310162f4f1f0f

Download Submit
memory/2056-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2056-6-0x0000000002D20000-0x0000000002E10000-memory.dmp

Filesize
960KB

Download
memory/2056-10-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2520-9-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2520-11-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download