04dcd8c1c53071a3b7ffba400d9fd6d99828c8eb7c900c416bab35d714da8595

Analysis

max time kernel
101s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e13e58104a65e3a94b1ff9b86a25130N.exe
Size

264KB
MD5

9e13e58104a65e3a94b1ff9b86a25130
SHA1

16234b8330009d312c41c5c583edf32046d4fa47
SHA256

04dcd8c1c53071a3b7ffba400d9fd6d99828c8eb7c900c416bab35d714da8595
SHA512

9b7745dc76ef3e65665893dc1d53e42e8040e009e31b76d8e75dd0d663573d5f6691c25a758d897abc7d9df5319be18630099d1d3a12103e2a5b10e6866909f6
SSDEEP

6144:06gApdy7MbeudNws0NRK5g3gb1EIDi8kzvh95Qr2:06g7ezdNw5Rm7qIDxILA2

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3364	9e13e58104a65e3a94b1ff9b86a25130N.exe

Executes dropped EXE 1 IoCs

pid	Process
3364	9e13e58104a65e3a94b1ff9b86a25130N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2776	412	WerFault.exe	83
1932	3364	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e13e58104a65e3a94b1ff9b86a25130N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
412	9e13e58104a65e3a94b1ff9b86a25130N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3364	9e13e58104a65e3a94b1ff9b86a25130N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3364	412	9e13e58104a65e3a94b1ff9b86a25130N.exe	91
PID 412 wrote to memory of 3364	412	9e13e58104a65e3a94b1ff9b86a25130N.exe	91
PID 412 wrote to memory of 3364	412	9e13e58104a65e3a94b1ff9b86a25130N.exe	91

C:\Users\Admin\AppData\Local\Temp\9e13e58104a65e3a94b1ff9b86a25130N.exe
"C:\Users\Admin\AppData\Local\Temp\9e13e58104a65e3a94b1ff9b86a25130N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 376
  2⤵
  - Program crash
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\9e13e58104a65e3a94b1ff9b86a25130N.exe
  C:\Users\Admin\AppData\Local\Temp\9e13e58104a65e3a94b1ff9b86a25130N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 344
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 412 -ip 412
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3364 -ip 3364
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9e13e58104a65e3a94b1ff9b86a25130N.exe

Filesize
264KB

MD5
a3893474c4e1f9d13a98b9cabb29c470

SHA1
75c3aec04e3d1dffe8ffe93482e2a30a9540f9d6

SHA256
84bf1004a97dce64ad70de702e8a23a973758587a22259d6cc89652c021cac50

SHA512
ab79aaeae64349e3f91738e2c347d2919c7fa047a4f0947f537b5569cd219ef1879201c7b5b20b2c00e1cd472bfacfbf6dd8b2dd7c5e1d021528b4cb66dd2911

Download Submit
memory/412-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/412-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3364-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3364-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3364-13-0x00000000014C0000-0x00000000014F6000-memory.dmp

Filesize
216KB

Download
memory/3364-14-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download