Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 01:08
Behavioral task
behavioral1
Sample
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe
Resource
win7-20240708-en
General
-
Target
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe
-
Size
40KB
-
MD5
4a683b19df48d3d0648687e2d5a9aa4b
-
SHA1
d801e10fe987f448dcaef191f5f3bfe08bdbe158
-
SHA256
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d
-
SHA512
f90b1264924c3efab1836c417b0478d9ffca9cb81123c61ca7bdac7d16dc63e6ec121474f79f84a0261271f5b46409fb3688f7e791ecc392ac34ff215ada08a7
-
SSDEEP
768:TeSXrX8ltlmge8gzRB0Tv04VZcwFqCqDfQJ:TfrezZg92TvZmzf+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2516 lanmanwrk.exe -
Loads dropped DLL 6 IoCs
pid Process 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/files/0x00090000000175e4-3.dat upx behavioral1/memory/2360-9-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2516-15-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iexchg.dll 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe File created C:\Windows\SysWOW64\lanmanwrk.exe 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe File opened for modification C:\Windows\SysWOW64\lanmanwrk.exe 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2496 2516 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2516 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 31 PID 2360 wrote to memory of 2516 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 31 PID 2360 wrote to memory of 2516 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 31 PID 2360 wrote to memory of 2516 2360 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 31 PID 2516 wrote to memory of 2496 2516 lanmanwrk.exe 32 PID 2516 wrote to memory of 2496 2516 lanmanwrk.exe 32 PID 2516 wrote to memory of 2496 2516 lanmanwrk.exe 32 PID 2516 wrote to memory of 2496 2516 lanmanwrk.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe"C:\Users\Admin\AppData\Local\Temp\9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 1003⤵
- Loads dropped DLL
- Program crash
PID:2496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD54a683b19df48d3d0648687e2d5a9aa4b
SHA1d801e10fe987f448dcaef191f5f3bfe08bdbe158
SHA2569dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d
SHA512f90b1264924c3efab1836c417b0478d9ffca9cb81123c61ca7bdac7d16dc63e6ec121474f79f84a0261271f5b46409fb3688f7e791ecc392ac34ff215ada08a7