0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e

Analysis

max time kernel
101s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe
Size

190KB
MD5

797a8cb0e549feb4692b4f82e3506926
SHA1

19c0e88667ca561134f81f55d855a8e60dcae30a
SHA256

0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e
SHA512

f0ff7d98bdc80e98ed47d0d35345096bd572297c158c68ec21bb08e4817253e2e7f6a72c1f21a1df7238c50163b904a0864db1403aba2484cb1caed62c91d9b3
SSDEEP

3072:V5uJKO3A/L9b596C/Gj75yF28etF7IX3/v/IsPr7N7juId2trxnUW9qS0v:VzB5oCuj75yELbMnIsdQmWbU

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2324	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Loads dropped DLL 1 IoCs

pid	Process
2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2324	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2324	2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe	30
PID 2560 wrote to memory of 2324	2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe	30
PID 2560 wrote to memory of 2324	2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe	30
PID 2560 wrote to memory of 2324	2560	0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe	30

C:\Users\Admin\AppData\Local\Temp\0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe
"C:\Users\Admin\AppData\Local\Temp\0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe
  C:\Users\Admin\AppData\Local\Temp\0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of UnmapMainImage
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\0eba7d59d1376817af2eedb4d3336081e9bb2cd311c7e3fceb521130e4d9505e.exe

Filesize
190KB

MD5
373f7251218d6bfc3c6284149d338965

SHA1
160ee21c1900efc21e0ec32295783ddf6e37a3e7

SHA256
554e2c503418fa309a4cff96f96e9fc9018fdd3c5698cffa5575de4be49dc9d9

SHA512
3126f5a9cb7549ac0e5497adfa7de26c570290d07e2ea158fc479bbc51fda38873bc20522ea936ca08eec12f17c710f8ec15ecc76de7275c83e232a2c9f93f30

Download Submit
memory/2324-10-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2324-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2324-16-0x00000000001E0000-0x000000000021A000-memory.dmp

Filesize
232KB

Download
memory/2324-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2560-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2560-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download