5f756375f69c4235c81e77e02b6604fa4ced9ac15ae27e717af34e65640714a5

Analysis

max time kernel
80s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35535548bfb25a31ab9025f55297240N.exe
Size

619KB
MD5

b35535548bfb25a31ab9025f55297240
SHA1

d3be6579169c6100982d96fd392b42db9c62287d
SHA256

5f756375f69c4235c81e77e02b6604fa4ced9ac15ae27e717af34e65640714a5
SHA512

be0c52bca11fa121b9f308935c27d5f077a77bdc8319d96edd53020d5f5edf0a25c5be9943b4c058701431f726d7fb3a4588d2e564149e9b275c70eb432f3c26
SSDEEP

12288:cV3nKSjGzOsDfvAQPVQ5zCD4VZRDGWF1m3aYhOA6eXVg:cV3nKSjEOsDHAQPVQ5zY431CaYAeXVg

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2312	b35535548bfb25a31ab9025f55297240N.exe

Executes dropped EXE 1 IoCs

pid	Process
2312	b35535548bfb25a31ab9025f55297240N.exe

Loads dropped DLL 1 IoCs

pid	Process
2508	b35535548bfb25a31ab9025f55297240N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b35535548bfb25a31ab9025f55297240N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2508	b35535548bfb25a31ab9025f55297240N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2312	b35535548bfb25a31ab9025f55297240N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2312	2508	b35535548bfb25a31ab9025f55297240N.exe	30
PID 2508 wrote to memory of 2312	2508	b35535548bfb25a31ab9025f55297240N.exe	30
PID 2508 wrote to memory of 2312	2508	b35535548bfb25a31ab9025f55297240N.exe	30
PID 2508 wrote to memory of 2312	2508	b35535548bfb25a31ab9025f55297240N.exe	30

C:\Users\Admin\AppData\Local\Temp\b35535548bfb25a31ab9025f55297240N.exe
"C:\Users\Admin\AppData\Local\Temp\b35535548bfb25a31ab9025f55297240N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\b35535548bfb25a31ab9025f55297240N.exe
  C:\Users\Admin\AppData\Local\Temp\b35535548bfb25a31ab9025f55297240N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\b35535548bfb25a31ab9025f55297240N.exe

Filesize
619KB

MD5
3799e5a09dda0a3a9365a2aecdfb6527

SHA1
502fd98e2e2a8d8a8c35f0b10e9f1c25d0340f95

SHA256
57362acc57838cd618f203d8bd3f10845c1ee5884d74f21122c63481f9b22ee0

SHA512
b613021a6ac6c23b67835df23a713ebe75072951dc380141de927d10b2867cc7d9a2a074c952d3a96bc9439ddfe9020e30e106c9b3d273d2134d9a4648a65d35

Download Submit
memory/2312-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2312-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2312-18-0x0000000000190000-0x00000000001D2000-memory.dmp

Filesize
264KB

Download
memory/2312-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-6-0x0000000000180000-0x00000000001C2000-memory.dmp

Filesize
264KB

Download
memory/2508-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download