e3bf881a829d9dc1c547bb9e12ba64b5da4363826f14324cf43828ebd220e8ad

Resubmissions

26-08-2024 03:15

240826-dr9cgssakf 5

03-08-2024 03:12

240803-dqdjeswdlh 5

Analysis

max time kernel
312s
max time network
319s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe
Size

1.3MB
MD5

8ecccce1c72ed53d0d9954fd30388f73
SHA1

3752f578eb2974604c4dc295cda75f5e9d75c40b
SHA256

bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4
SHA512

6cb9f9c7a9655157bcf8633b0422559d2b906576afa73a22acf4ad22167eab12df58ead997f27d0dc6721c1a7beeec845f7ee5647d1cc49f78358670262f206d
SSDEEP

24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aHfPevudnP98jsiL2:iTvC/MTQYxsWR7aHfcWPGLL

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe
1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe
1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30
PID 1104 wrote to memory of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30
PID 1104 wrote to memory of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30
PID 1104 wrote to memory of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30
PID 1104 wrote to memory of 2248	1104	bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe	30

C:\Users\Admin\AppData\Local\Temp\bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe
"C:\Users\Admin\AppData\Local\Temp\bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\bac08253e102c87b2ccdf9f495fd934418ab784ec88951fbf30ee47475f266e4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Prober

Filesize
375KB

MD5
ee0dc0012329a9085c7f41420964e54d

SHA1
c73d07bbc0085fc82af5f61846e46835583b7061

SHA256
3b9f112fb7d84a4dd76828b1d91ab73da140d51dd149eea85a3b5c18028d6409

SHA512
495b6a581ae45c4fd61a8e65680998db99eccf4f301524ad109dd9426a6678f4222a1d7a6157b5e19a15f496ca46774fe32d7abada1eb24b5f602e1e427bd475

Download Submit
memory/1104-12-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/2248-13-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2248-15-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2248-16-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2248-17-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2248-18-0x0000000002230000-0x0000000002533000-memory.dmp

Filesize
3.0MB

Download
memory/2248-19-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download