e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe
Size

63KB
MD5

094742a6e72c1696c8b2dbddea24338a
SHA1

f70f3198e0fea60d1285e2a911223332b68d2aad
SHA256

e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437
SHA512

94b59327fbbef7c8749bd25b437bffee9a6da110663724dd81b1e7eb37adbe00d44de305283d5663d93ff0e95ca7fdf5c252131e6dc034b72d34f8085181da59
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ36ucA:ZVxkGOtEvwDpjcab

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2992	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2752	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2992	2752	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe	30
PID 2752 wrote to memory of 2992	2752	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe	30
PID 2752 wrote to memory of 2992	2752	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe	30
PID 2752 wrote to memory of 2992	2752	e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe	30

C:\Users\Admin\AppData\Local\Temp\e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe
"C:\Users\Admin\AppData\Local\Temp\e9f43013f48f62be185ccd983cdbd406a7713b4716470aa817281529476e6437.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
5c66c688f1d3ed2e1e0bd6e8a9f4e7e2

SHA1
9d1f1f1a82cba74eb31c8f50f0c425c0dcb2fa79

SHA256
6fcf893c411c6901ca2ac8687dbba9b7eba1be19d1a2d23ac6765f550d8d7a19

SHA512
c97642b359d9dbf9c9597718e7b0bb046036a9bea76967367eae1222606042aa977af7c2208ce8b93af1703e03e4b933edecbcc14d0c97a3829fe68becdf4bc4

Download Submit
memory/2752-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2752-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2752-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2752-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-15-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2992-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2992-17-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download