cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
Size

217KB
MD5

60adda85b7de44b3bde5aa6c722176ac
SHA1

0b7ac69b808edfc4da208a7ecc513bf077d75410
SHA256

cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2
SHA512

cfd105a1b09a38faf6eebf7ccde3206939d5c58f642d150e56ae696437d62a12e113d19d9ecd2126b0c0475955a7fc9b2863230ad5b4c065935acd544e756716
SSDEEP

6144:GC/KTXod3uQcREj3mWKkvFnnj+zi6MdyiN0:G+54EjpKSjBdyie

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1244	wlan_test.exe

Loads dropped DLL 5 IoCs

pid	Process
1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1244	1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe	30
PID 1380 wrote to memory of 1244	1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe	30
PID 1380 wrote to memory of 1244	1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe	30
PID 1380 wrote to memory of 1244	1380	cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe	30

C:\Users\Admin\AppData\Local\Temp\cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe
"C:\Users\Admin\AppData\Local\Temp\cccdce824faa0744b1db5a1aa1dc0b4d0c25364492bbb7c616c229a3cada4cd2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\wlan_test.exe
  C:\Users\Admin\AppData\Local\Temp\wlan_test.exe
  2⤵
  - Executes dropped EXE
  PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\LangDLL.dll

Filesize
8KB

MD5
e5240dcd169abe69a7332d01106e1d84

SHA1
2ca68892501102586f6ab4eb99744d7f6138c166

SHA256
96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

SHA512
519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\System.dll

Filesize
29KB

MD5
26c8a92678f1b970ac2a700bb844c309

SHA1
c821a5980c31b0b35f1505cde836d6769f45e3a3

SHA256
2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

SHA512
fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\nsArray.dll

Filesize
12KB

MD5
da4bc09439ed21faf7620a53433aac92

SHA1
94e3347aebe16cb88b9f29f00134d9e0fb67e508

SHA256
216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0

SHA512
920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8F55.tmp\nsExec.dll

Filesize
11KB

MD5
7c0dc12cdc807a3bb4afda989a663f95

SHA1
3db74d921bd68ce73834de4636bbec03b21723ff

SHA256
0d022cc0aa60a3f41dbeb6776e9acb016ff3d42396e3371f15cc22352e621eb5

SHA512
22301b351c0332fce7b0d6b21e2b1dc9a850658b8ac610bfa4fb9d02adfbdad30211f04edcabd4141574d243cb6333ef78adb6647860641c84e5d6dc6f635a20

Download Submit
\Users\Admin\AppData\Local\Temp\wlan_test.exe

Filesize
8KB

MD5
40bca6124fa7eef106c0d76c428d9471

SHA1
dadd29d90007602be8ecd18406dc28634d0bbb2d

SHA256
fc03209d76e6c41c11dde8621f1eb03ff348a12566cb9b63e7aa2d6cef8086aa

SHA512
5167d2bbe094dc7a3ecf89e508ae869dcff08c4159b7756cb03c2f5431e084ff34d1834e5294892f81f00e96664a67081d8212dde310f553a7f6237a1144a5be

Download Submit
memory/1380-38-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download