bd3d6691ad6d498e0038ec70ccdbaf9a0d94c170312d91719f919236256ece5f

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe
Size

393KB
MD5

069e0d82a0ccd6833b7910d3cdf7bfc4
SHA1

4d75f5b9602c28f32473fa0af0db3e797c1225d5
SHA256

73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45
SHA512

b765f7b4d126a60e40cd13083ca02f6b88c105e35cc22384fab374344fac1c86ec06bcc8061f66dbfdfaed690b1a914d2249ba053d5516c4157102566707a3bf
SSDEEP

6144:GsE0IFuuUlZJhe0Zw90nHgW9hsrVuhhHe4SUj5XEHvemX3UffG6nC7:GsE05umZPem7nAW04hrr54gfzC7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1696	cuwqrwrdhw.exe

Loads dropped DLL 1 IoCs

pid	Process
1944	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cbdukno\cuwqrwrdhw.exe	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1696	1944	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe	29
PID 1944 wrote to memory of 1696	1944	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe	29
PID 1944 wrote to memory of 1696	1944	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe	29
PID 1944 wrote to memory of 1696	1944	73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe	29

C:\Users\Admin\AppData\Local\Temp\73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe
"C:\Users\Admin\AppData\Local\Temp\73c9946c672b8cfbc708125766eaae4112868dddeffa54c3f7d2c9b404916a45.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\cbdukno\cuwqrwrdhw.exe
  "C:\Program Files (x86)\cbdukno\cuwqrwrdhw.exe"
  2⤵
  - Executes dropped EXE
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\cbdukno\cuwqrwrdhw.exe

Filesize
407KB

MD5
df81dacdb64b8925f1d043c293b36504

SHA1
da69db39a264d43be2754ea76c5b7ae28097ddd3

SHA256
66f21d17f580e7c82b01f7bf18d10221244fe4624506307bdce8194b3ecde509

SHA512
041e34edeeb9673d3d4af533a54b6e1bcbc26cae239e38cd7ed43dd0bad0e372619ded9172619f244d663e147367edfc4ffdc5126b831d2e99bccb0cef369322

Download Submit
memory/1696-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1696-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1696-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1944-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1944-1-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1944-6-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download