13ea3a924c0ebdeb9820d4b8d0eb70542d928ee479c6284f44adbc8136638a9a

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f807329c584f7192f3ca395cbe544530N.exe
Size

90KB
MD5

f807329c584f7192f3ca395cbe544530
SHA1

afabf70907c72e9319cd1bd8bef3a6e2b29b12fa
SHA256

13ea3a924c0ebdeb9820d4b8d0eb70542d928ee479c6284f44adbc8136638a9a
SHA512

f34a6c8dffc4bc2e264599e748370d3187f6a27f0dff76dd5258db979ca7e3fcc7f92979a183c337ed89f516ee0eed79f5b488a1f76fd9df9153e2f0ee4ba6b9
SSDEEP

1536:p3AT8kLL82H+zBa8s6c95azkQS8WDy8g83QLTW8IYek8twP+YPf:pQTnLo28a8sF9RQRN83QLS8dekfPFn

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2688	f807329c584f7192f3ca395cbe544530N.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	f807329c584f7192f3ca395cbe544530N.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	f807329c584f7192f3ca395cbe544530N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f807329c584f7192f3ca395cbe544530N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	f807329c584f7192f3ca395cbe544530N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2364	f807329c584f7192f3ca395cbe544530N.exe
2688	f807329c584f7192f3ca395cbe544530N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2688	2364	f807329c584f7192f3ca395cbe544530N.exe	31
PID 2364 wrote to memory of 2688	2364	f807329c584f7192f3ca395cbe544530N.exe	31
PID 2364 wrote to memory of 2688	2364	f807329c584f7192f3ca395cbe544530N.exe	31
PID 2364 wrote to memory of 2688	2364	f807329c584f7192f3ca395cbe544530N.exe	31

C:\Users\Admin\AppData\Local\Temp\f807329c584f7192f3ca395cbe544530N.exe
"C:\Users\Admin\AppData\Local\Temp\f807329c584f7192f3ca395cbe544530N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\f807329c584f7192f3ca395cbe544530N.exe
  C:\Users\Admin\AppData\Local\Temp\f807329c584f7192f3ca395cbe544530N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f807329c584f7192f3ca395cbe544530N.exe

Filesize
90KB

MD5
efb956e7a0d6171688d39513585b2622

SHA1
a1b93805f2dc555cfeaab0f1d6fc3f41e62b5771

SHA256
bb59f5a987d722e403a73bb276c5d46fe083164ef1913ed204c3dd16cc4d9533

SHA512
f8094df707dfea9dd1177dcbfdb76eddfd9cc9eb8962c52035220ae0a0ed8ba0e21705a550f9b64f5acedeed99913dd69b9e7a008a4de468f9ba216f4e28cf31

Download Submit
memory/2364-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-9-0x0000000000140000-0x0000000000173000-memory.dmp

Filesize
204KB

Download
memory/2364-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2364-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2688-29-0x0000000000340000-0x000000000035B000-memory.dmp

Filesize
108KB

Download
memory/2688-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-18-0x00000000002E0000-0x0000000000313000-memory.dmp

Filesize
204KB

Download
memory/2688-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2688-30-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download