Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 17:13
Static task
static1
Behavioral task
behavioral1
Sample
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe
Resource
win10v2004-20240802-en
General
-
Target
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe
-
Size
3.4MB
-
MD5
b141181267a67d6e898a4091456b7f5a
-
SHA1
ea49baf5daf60ef7903bbb0bc2eb5cebf91c2b69
-
SHA256
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90
-
SHA512
51da433086af221c69a6dd8829367e7ce627f74cc2cdeaab00b2db41cb591bc7fd7e139b83cea1110e5e9380cea8b6bd168499a544e92dbbbd8e0e2aac5dced9
-
SSDEEP
49152:oF5zMm8cujegszQX+LEgUhzRSPCMtGQBU9rZnG3kIKFef76CV18Ub9VaHPj:K5zZ80gsEX+LjmzRS6MZmgKOd9ViPj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmppid process 2568 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp -
Loads dropped DLL 3 IoCs
Processes:
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmppid process 2568 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp 2568 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp 2568 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmpdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exedescription pid process target process PID 4936 wrote to memory of 2568 4936 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp PID 4936 wrote to memory of 2568 4936 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp PID 4936 wrote to memory of 2568 4936 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe 6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe"C:\Users\Admin\AppData\Local\Temp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\is-85HRR.tmp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp"C:\Users\Admin\AppData\Local\Temp\is-85HRR.tmp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmp" /SL5="$502C4,3143642,121344,C:\Users\Admin\AppData\Local\Temp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-85HRR.tmp\6423892b20db4819176000653741a0ae80d6bcf8edd4de7faea1bc6a3488aa90.tmpFilesize
1.1MB
MD5e845838d99d29c4bba4ad35ee996dea3
SHA134a9f433ce1e3339e07d75f0a74efd676b1d7cca
SHA256b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
SHA512fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d
-
C:\Users\Admin\AppData\Local\Temp\is-IMD1A.tmp\idp.dllFilesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
C:\Users\Admin\AppData\Local\Temp\is-IMD1A.tmp\isxdl.dllFilesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
memory/2568-6-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2568-16-0x0000000003350000-0x0000000003372000-memory.dmpFilesize
136KB
-
memory/2568-20-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/4936-0-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4936-2-0x0000000000401000-0x0000000000412000-memory.dmpFilesize
68KB
-
memory/4936-19-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB