18d275d0c33d0fec0763d07981f0974b1edfd164625592deab0a24d16b4ad651

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe
Size

980KB
MD5

049984d295fdfdccff31c330e3155c03
SHA1

fbf8ca77d6343f2de9fc7e03540bbff7025df1cb
SHA256

7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647
SHA512

e23c630348ffb1f4d6d6bb1443655983b6fbbef8a9f2a03c76668034867d1a59a866a3abbc1240d13f8b115bdea1074f2d5dffa5c6d35468604ab75639f0427a
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuG1rnxpW/dRbts4:dqgazxcG1Dx+dvd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2060	gqickdjuaobppk.exe

Loads dropped DLL 1 IoCs

pid	Process
1584	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\obgacr\gqickdjuaobppk.exe	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gqickdjuaobppk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2060	1584	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe	30
PID 1584 wrote to memory of 2060	1584	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe	30
PID 1584 wrote to memory of 2060	1584	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe	30
PID 1584 wrote to memory of 2060	1584	7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe	30

C:\Users\Admin\AppData\Local\Temp\7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe
"C:\Users\Admin\AppData\Local\Temp\7cf2ee0dff630f22addebfeefd63cb3339599155b353ae0ffaaa9a09eac80647.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\obgacr\gqickdjuaobppk.exe
  "C:\Program Files (x86)\obgacr\gqickdjuaobppk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\obgacr\gqickdjuaobppk.exe

Filesize
993KB

MD5
52d354b5295810d52cb6b653e5a07298

SHA1
642f8ecfde154df6cdf72068f834b64703327308

SHA256
a2909e65c5b1bd611887dddf8830b3a5f3767de5f51cf214786a0da44d922593

SHA512
f2f2e8eb02c43f2ae7431843a7c7542783ebd32ac3ca84fc171003bffdaf7d93bcd3f6d70062413d2e40c99d9ec72ecc8d51a9142e6b85b6d972eaa5be029ce6

Download Submit
memory/1584-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2060-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download