3c9e2c1137438d3d9e56025227868aee1f6208cf58dc85ef9ce5832992d38e41

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe
Size

1.9MB
MD5

2c41e506ef975e34fb0b0e9bb1135c72
SHA1

b46722c10eaad3e56394f98b611cc2a79b66f2de
SHA256

49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68
SHA512

8e9924e18b885945c9082b9fc2342d2e87da6341483b6c3de5c7ccbf799b40140edd332f2dbf2aa996a8c7b43c0246fa6d6898263bffdc00794195d240bbef62
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dnX+qgen94+mEj0GxnXZfjuD9hkkK4z1jsxQh:Qoa1taC070dndgea+Kgp6JrK4z1js4UK

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2964	7CED.tmp

Executes dropped EXE 1 IoCs

pid	Process
2964	7CED.tmp

Loads dropped DLL 1 IoCs

pid	Process
2748	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CED.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2964	2748	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe	30
PID 2748 wrote to memory of 2964	2748	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe	30
PID 2748 wrote to memory of 2964	2748	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe	30
PID 2748 wrote to memory of 2964	2748	49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe	30

C:\Users\Admin\AppData\Local\Temp\49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe
"C:\Users\Admin\AppData\Local\Temp\49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\7CED.tmp
  "C:\Users\Admin\AppData\Local\Temp\7CED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\49e8a2da67b4008ab4734979df63ec0c7e819da007f1b8527c0f2a58c6a75c68.exe 9E84A47B3578ECCD0267A94B21345F95D2A84998391B7B68FB31CB7E22C6E9FBFEB9676EE58B6E2A24738C013E0A667E7E6987EEEB4AF6673AFAB3AC5BB169FE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\7CED.tmp

Filesize
1.9MB

MD5
51d79316414975a79cb2b13242d462b7

SHA1
994a94ddac6e82b5112a5c7d0dde8023f2ef940e

SHA256
a9ad5a251c03b114be8fb44784c1d23eeac0e335af0c29a17321d60df24ebad8

SHA512
749cd1b56511041519739ddd1ad0acfc12b79b16936f762ef3d77d1841404cf35651be88b4ed63aa884ca310ab5864a68523166fa72f761b63d4c3120e199d95

Download Submit
memory/2748-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2964-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download