c86331bb4c728f1d07a7c466478dc540f0e0c29b1f7f6647be5a295bc5f28e56

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe
Size

1.9MB
MD5

655226e5d9239a83249cd3d6906b9aa2
SHA1

d9fb668ff08007004c26c26734d73be8e9069d4b
SHA256

3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619
SHA512

77957140cdadf9840e7cd71b188f45b194ddad257b5a6f57daf56599ea9e69406e1226632eeddb9622de5548e228c8885a0eb97bf0d2537e6c493fd9b22dcb23
SSDEEP

49152:Qoa1taC070dqOGFKVrTqA9+Yjnx8Rjq3t0:Qoa1taC0oGFK4A9+2n6RN

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	A950.tmp

Executes dropped EXE 1 IoCs

pid	Process
2744	A950.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A950.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2744	2928	3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe	89
PID 2928 wrote to memory of 2744	2928	3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe	89
PID 2928 wrote to memory of 2744	2928	3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe	89

C:\Users\Admin\AppData\Local\Temp\3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe
"C:\Users\Admin\AppData\Local\Temp\3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\A950.tmp
  "C:\Users\Admin\AppData\Local\Temp\A950.tmp" --splashC:\Users\Admin\AppData\Local\Temp\3f2677a0956d7fee1f1feeebaaae3fffab3cee42e6e12b6e6bfdd8167c9d1619.exe 2853BC1182BF42BE3C1A59876C7014FA1BBA2DD9341E5812B83BA657DA9EF8C0C3663142B21EB4B60DE5EC0C748FEE855FD13A6534A2AFBBB5871A44B8DCE465
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A950.tmp

Filesize
1.9MB

MD5
c14929871c47c47a0c272abc13e04307

SHA1
f0958cb4b62e4ea53fd9f07db966b33592d878aa

SHA256
74b176ade7d4a69c3a5531217603f71f87f42ef4000db5aa4e5146c4f9cee8b0

SHA512
a2af151f7cf829e79de411b523a3d1e3c943a8395db1445d33bb9beaa7ccbb20107e5ae52d490b2f8ac8e6d363232f0337862fa45feba140ffd55e08cf0d203f

Download Submit
memory/2744-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2928-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download