1661cae45f54a23d3233c67afcf093a7140f2d06f91a95a238200f46e8c235f6

Analysis

max time kernel
84s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe
Size

1.9MB
MD5

4e82053b6c64ad80a9c928919a8b82bc
SHA1

a139235a9b69ed2fef737d00adb93a2faede36b0
SHA256

9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06
SHA512

0c45660972cc5f1117fecf295d9a8c3d5e03d8b2ddc09303c0d2e5e94961d08f9fd26a1d462889aadbbd2643978ebd7b36c33630f4b439ef0d3023c4f154758b
SSDEEP

49152:Qoa1taC070dtisyERy+F520py5WjNNPQigwhm:Qoa1taC0OisyoyoPyQNlRXQ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2384	6D4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2384	6D4.tmp

Loads dropped DLL 1 IoCs

pid	Process
2336	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D4.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2384	2336	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	29
PID 2336 wrote to memory of 2384	2336	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	29
PID 2336 wrote to memory of 2384	2336	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	29
PID 2336 wrote to memory of 2384	2336	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	29

C:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe
"C:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\6D4.tmp
  "C:\Users\Admin\AppData\Local\Temp\6D4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe 9BE6689C4836116F726E5253243DD8B38E945525AB8E7ED6ACBD784FF1E45FB229729680C942936DB7952B623FDC7B7FF44ADC267318BC9F1ABB40246E18C717
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6D4.tmp

Filesize
1.9MB

MD5
ed95d3a47be5db327a2c475833e244fe

SHA1
b90c395dbec3df17ad0ab4d08deca63789756f35

SHA256
59c10661251b340953b4f86a9b4cd9c37441cff996c3182a79617a419fcc6cab

SHA512
f28260f8d9f45b98a898f862964982c6759e164a1a8dbc9ce75c1d22884672af909bad5921e482f4718d52f422ff0f8d4c48e59a2925886c41e985d5a0510689

Download Submit
memory/2336-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2384-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download