f662d4a7d462081649f244689bd04df4b530b86590141f560b26423ab4e200f4

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe
Size

1.9MB
MD5

589a5fc1d8490baf7900810bbc07a73c
SHA1

ef6fbb97a5b29e9c9eabb25cfc387ed891b81d70
SHA256

fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1
SHA512

3553ee7faf14916a97e9abfc6398fa9fb34e186687dc65250513a519aa2c9ea121b813ce87ddf5877cc1a2154b5d576a7913461037e80eaff0f9b979691b643b
SSDEEP

49152:Qoa1taC070d+X28X7HGKepZmxVY9L+6/Uy9:Qoa1taC0TrHhSClu

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2392	4A88.tmp

Executes dropped EXE 1 IoCs

pid	Process
2392	4A88.tmp

Loads dropped DLL 1 IoCs

pid	Process
2280	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A88.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2392	2280	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe	29
PID 2280 wrote to memory of 2392	2280	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe	29
PID 2280 wrote to memory of 2392	2280	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe	29
PID 2280 wrote to memory of 2392	2280	fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe	29

C:\Users\Admin\AppData\Local\Temp\fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe
"C:\Users\Admin\AppData\Local\Temp\fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\4A88.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A88.tmp" --splashC:\Users\Admin\AppData\Local\Temp\fb5e76b0a9116fc7e32dbd7ea0f42cfb3ecddc210709dded37b4dc7b35a22ef1.exe E8FF88435897A6356010C51D3CCA77CD537E2269D5E6913CA90DC927555044A2D2C63997AA9A5896EF82F00195408439A84C9C91AA0088C2E2DDAB9280298F24
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4A88.tmp

Filesize
1.9MB

MD5
7cf1524b55a4e07f3a935f0a9577577a

SHA1
d8dd25e19807838524ee0b416c58990fccea93ce

SHA256
aa49ecac3b481e061021e405110853e477a048c844c24fc1365ca706b9f49f60

SHA512
993254b87a5a50fb2603a5f6723f3bbf019685a4a78b684de40041d5a9291e1489a6264e769733cfa9f4a51ea07d75a33139254abf4f9fe941e4fff5f1337c06

Download Submit
memory/2280-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2392-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download