1ddc8a5e5d1358e106b052e6182ef7b475f9b9259b7fd0a95b45ab1481148b36

Analysis

max time kernel
103s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b19583322bc865128a7619a0739a0700N.exe
Size

129KB
MD5

b19583322bc865128a7619a0739a0700
SHA1

403bf68207a3994f330752a9f7d7a74a1eba4d26
SHA256

1ddc8a5e5d1358e106b052e6182ef7b475f9b9259b7fd0a95b45ab1481148b36
SHA512

3793ee305b5b77e53b4c06f79e9585fed2cf1ed33fa69dbfd524fa74bf4cc56055f8cd30b99dda868dd37c12d71816156f9197a278e3b99c480c26f360feb0e5
SSDEEP

3072:knZjfso0f5z9f57fgDWChiOzl0LEnFvUf4FnWRYCdG:kndp0f5z77fgDNlzl0L0dUf2WRNdG

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
644	qmaeobe.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\qmaeobe.exe	b19583322bc865128a7619a0739a0700N.exe
File created	C:\PROGRA~3\Mozilla\dalbirl.dll	qmaeobe.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b19583322bc865128a7619a0739a0700N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmaeobe.exe

C:\Users\Admin\AppData\Local\Temp\b19583322bc865128a7619a0739a0700N.exe
"C:\Users\Admin\AppData\Local\Temp\b19583322bc865128a7619a0739a0700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1632

C:\PROGRA~3\Mozilla\qmaeobe.exe
C:\PROGRA~3\Mozilla\qmaeobe.exe -tubeilc
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\qmaeobe.exe

Filesize
129KB

MD5
5422a2d0952b398e9d17de720b9b18f1

SHA1
45885fb52068cb9c39615c315f14820ffbe0bd0d

SHA256
375d859967b3e93dfe6d7d16f9277f0ab68135e307038182a6f9f99be9a36b98

SHA512
62dd4ba568d395aad8560186e92e875500194963e6b29620dccd990d6422e671a8072201f101b72b0ffb99da6c5b6510042b713ee9f105dc8547a54de8914ca2

Download Submit
memory/644-11-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/644-12-0x0000000000900000-0x000000000095B000-memory.dmp

Filesize
364KB

Download
memory/644-18-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1632-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1632-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1632-2-0x00000000023B0000-0x000000000240B000-memory.dmp

Filesize
364KB

Download
memory/1632-9-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download