5ea84f8f933017eb51519e628002909ba5dcf81a34830147ff2368a9d430496d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/tango_mp3king.exe
Size

5.4MB
MD5

0fdcebc29b02dda89cc8c9dcba2262b0
SHA1

af17b50834012fe71ce3544618a6e8632e65b8e2
SHA256

8e155b1720598fb117400b9d3c30d2652daebef1fb4057ff499d03f3459a64ad
SHA512

29ba0db467613bc4490d6b81955ceaca7e3dec3798079a48a3dcca83f620f99c8e4d15411668cb6709628f7836086f3ea38ad319fe5d3463c8a5bf58b2e4a871
SSDEEP

98304:AWB6vYSPJ6CNmFviM2TRRL3vVwsdUaUcMHQvPGMlZXiCOtYtuvE3kz:AWQPsCkl4/L+sdNyyOMlZXiCPkT

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2136	tango_mp3king.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tango_mp3king.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	tango_mp3king.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\tango_mp3king.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\tango_mp3king.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdC821.tmp\ioSpecial.ini

Filesize
644B

MD5
2c0e1a291e9e7b0aaa115ccca92831cb

SHA1
dbd342da58fe6065519a20092bd43181c9775a90

SHA256
e7f37ea8e2c756f9d0fc2bbc7398e6e1379f67c2a7c14f9a2a19815f4be1ee95

SHA512
736d67359e496d1eb67e84475296ddc3c94b6e66ddd503071413ad2c26269c3f4a277ded98198158968cf92ba71ede04cb4cea59296907f4f08198a9b1fff28f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdC821.tmp\ioSpecial.ini

Filesize
605B

MD5
5150e712adf4ef6f4f56938d546a79f2

SHA1
f78682cd3112deb707e017e05b3c7d657827160f

SHA256
521c8bacd9992bebe5a2c12efec893f352a3bac6302e233b0f47f7830f161c70

SHA512
cca97c4994f821caa04d3ff3068d5af374bf888df3e2721d1db3a0730ae8173bf1f0d6d02d115459ba4a857cfff155205d001802fe7c5f7630ea28f9ec446f1c

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC821.tmp\InstallOptions.dll

Filesize
15KB

MD5
9a886711c559308c39c01c20e9d9a1e3

SHA1
0f27cf1cf6e4960e140651b68d72ed4b92c58e9e

SHA256
98be8860d38ad9cf31b55a1a04594de59eabad67510ba2a33ed20a80863ddfa4

SHA512
4dabdd9ea7a8330a367589a3975a9dc7286b82c66efc7db118b4d7a2db08a467851c6d3dc991668e13c4dd5473aa974e9696a2226039db94df8b198da54354a3

Download Submit