bba31ffae4985cde504b3a8f3f68376fa757b03d82113b0ebc8ec1503cf85388

Analysis

max time kernel
92s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe
Size

1.9MB
MD5

32ddadf0723c029a83e10f30b785954a
SHA1

2f5df5db62501492bf5d21b140eae66df10ec8b4
SHA256

07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621
SHA512

79b56952f9303e0c5669e80642e29bea9d79769c85986594b281b7c1fb85381a15b820b98754b21da41ce804694513c9795d04c41ebf90e8eb3f1addb08bad22
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10drnw5FzW2HcCPeDx0OCk29Uv/qPQ4XubjNO8r:Qoa1taC070dzg1WYw0OCTIbQ8ehBE0YF

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3636	C8BE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3636	C8BE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C8BE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3636	2096	07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe	86
PID 2096 wrote to memory of 3636	2096	07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe	86
PID 2096 wrote to memory of 3636	2096	07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe	86

C:\Users\Admin\AppData\Local\Temp\07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe
"C:\Users\Admin\AppData\Local\Temp\07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\C8BE.tmp
  "C:\Users\Admin\AppData\Local\Temp\C8BE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\07f8f9a79220b237d1cb259144a7491760272710b813ee94f4002b4df7066621.exe 6267A1681B5249EB7D6EF5970336A2734BB5B213C2046D6B4171A7B9BBE039716FDA6584FFF7A2747E6306ACAD076A67628981699D8DE92A57148EE3C6180349
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C8BE.tmp

Filesize
1.9MB

MD5
47e4767dc5420332f33f737350bd7d80

SHA1
00dffbe3df3f98a9f16c06f4d33dd8ed91231e3f

SHA256
0812bd23e6bd79f814940cbf7656a9c9f77611f172b7c3bb15b389e822bbc2b7

SHA512
7036e8b9a82cb287d8d6a36e031d91e56b416a0eea509c5db5d33658c9073c213762c49b2505d14352c3ad4f1b1d6dfbec14118261057c048c5c61fc62a8491a

Download Submit
memory/2096-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3636-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download