0264d3216a2b87138e33229a1156ee06f3dc32365f20f1a2c3e431660bd6a9ef

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe
Size

1.9MB
MD5

2dabaff48d01a484453c334ad3051315
SHA1

16d69dd6940381d9a4b12ec4beac57022851c395
SHA256

f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8
SHA512

ed17014be476b83cf0a3034cb951ac0daff0f5fcb9519635de7fe546ed3de9f54e16389764f1009237e59902b76e7f49fd3c101eb914bfcf08f83f850b3485d8
SSDEEP

49152:Qoa1taC070dqS1EG3XptwxCDHe6oxoaAx:Qoa1taC0fYXj8CDHe6WYx

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3028	86A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3028	86A.tmp

Loads dropped DLL 1 IoCs

pid	Process
2444	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86A.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3028	2444	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe	30
PID 2444 wrote to memory of 3028	2444	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe	30
PID 2444 wrote to memory of 3028	2444	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe	30
PID 2444 wrote to memory of 3028	2444	f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe	30

C:\Users\Admin\AppData\Local\Temp\f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe
"C:\Users\Admin\AppData\Local\Temp\f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\86A.tmp
  "C:\Users\Admin\AppData\Local\Temp\86A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f208ed2b3f888c3c1b29dabf2043d5b3f6ca058b6d38a21f0c2dd7f2cb8bf5e8.exe 73B43525C32A5B5B84751822F47E6CEC0F28168B9BAFEBFBEECF7FD936C244652D182AFE609F596AFE91A1F3437B58550BA7D1443458AEF3CF4BCABA0ABA026A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\86A.tmp

Filesize
1.9MB

MD5
657f1bdcf14f1534a7ea2333d6058b7e

SHA1
581adb5c891c3637d0b21a16676bc87e6606c7ad

SHA256
97b53f075e2aa64ac0483b446e7bbe9e29bd16cfadca3cfeca72e8fa0400132b

SHA512
c401364d9b0b3751c3c7a057bab10b09da6e7e02d2ae80a81300528d7acae8de4ac20db761d36b60835608bcaaed30850b79500acdce6b1a58579dec006464e8

Download Submit
memory/2444-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3028-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download