1661cae45f54a23d3233c67afcf093a7140f2d06f91a95a238200f46e8c235f6

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe
Size

1.9MB
MD5

4e82053b6c64ad80a9c928919a8b82bc
SHA1

a139235a9b69ed2fef737d00adb93a2faede36b0
SHA256

9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06
SHA512

0c45660972cc5f1117fecf295d9a8c3d5e03d8b2ddc09303c0d2e5e94961d08f9fd26a1d462889aadbbd2643978ebd7b36c33630f4b439ef0d3023c4f154758b
SSDEEP

49152:Qoa1taC070dtisyERy+F520py5WjNNPQigwhm:Qoa1taC0OisyoyoPyQNlRXQ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2348	CAB2.tmp

Executes dropped EXE 1 IoCs

pid	Process
2348	CAB2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAB2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 2348	3720	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	87
PID 3720 wrote to memory of 2348	3720	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	87
PID 3720 wrote to memory of 2348	3720	9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe	87

C:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe
"C:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\CAB2.tmp
  "C:\Users\Admin\AppData\Local\Temp\CAB2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9c71b1596f6fe17341b941c292690d2137fc5f5deed5a5e2d66ed4b3a0281f06.exe 39DB96E3B01B501AD66072505FD53F2DC8FE2D2B9C8726FB8CBC59B67384CE1AB1F53194050036C574E5EF3E49A0607DD1C03FEE580D6F760E70CEA7651FB4DD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CAB2.tmp

Filesize
1.9MB

MD5
1eb8658d4fa41e38f4d90cd43a20b541

SHA1
4227a28564e552b2073d715360265821337c7b84

SHA256
483e47dff8046c77a2f0069f0952859a9f834b3c00b892abdc9ad79b9dd057f0

SHA512
8ef0d34f1d78da1d166d6b847fe111f52ab80dab0cbc6b0169fe714781ae81606f2981b21df19a98601ddef25c6e0785f8a9baac6f326d425aa47d3987cb35e0

Download Submit
memory/2348-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3720-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download