8e434c1a2d98ab1a12102ca633c4560bbf24862870fc976ff3d627222bddde5d

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

merge-xml-files.exe
Size

2.2MB
MD5

65000f41449863e2899e14c3b4c23972
SHA1

cd67722d20a2b919716f6e60bd658315feeaacdb
SHA256

8e434c1a2d98ab1a12102ca633c4560bbf24862870fc976ff3d627222bddde5d
SHA512

0c60f33644087f803bfc3d8d3b824b85326be19a0a3546e6cc2f691101e00f3f0a8075ca6d7460488ba3e32307d7188d1076302398264376abf6b6897f15a961
SSDEEP

49152:341PkcL6Cp7bY9JSS4a5/T3htT1aEQVglYwy+SkNWNF:c96ClaB73DsEQQYwsmS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2404	merge-xml-files.tmp

Loads dropped DLL 1 IoCs

pid	Process
2408	merge-xml-files.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	merge-xml-files.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	merge-xml-files.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	merge-xml-files.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30
PID 2408 wrote to memory of 2404	2408	merge-xml-files.exe	30

C:\Users\Admin\AppData\Local\Temp\merge-xml-files.exe
"C:\Users\Admin\AppData\Local\Temp\merge-xml-files.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\is-V21SC.tmp\merge-xml-files.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V21SC.tmp\merge-xml-files.tmp" /SL5="$F0150,1840041,203776,C:\Users\Admin\AppData\Local\Temp\merge-xml-files.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-V21SC.tmp\merge-xml-files.tmp

Filesize
1.2MB

MD5
291084970cd0de99571b332c1bb83a70

SHA1
9ed3ee5299f9fc188dc4db52689af9f9be705b50

SHA256
f59752cef8990533fad486375d312664e5cdee5748ffe1fbb6c333ea4dfbff90

SHA512
f7d0de8ef7fceea95ee0f5608d7b622837e52e2a1ef98f01196980d7a9d46fd599cde4be6edfd25a56bbac2d8c88af200fd03d5698657d3124b4486713b60293

Download Submit
memory/2404-8-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2404-11-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2408-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2408-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2408-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download