fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Antares Auto-Tune bundle V9 CE.exe
Size

110.0MB
MD5

cda53632778d1ced63a7c0809b71cb86
SHA1

f7d30963a0d45f35cc015f5c5e5ed58276b0e628
SHA256

fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
SHA512

8b6cd507fc76d75aa2d96d5546ef1d12f0c25c015bd195cee914d5501ec277b41801f1adb171ba67b164a3e7e68fd3d232ea9f7903cf11443f9a83db0be18b2e
SSDEEP

3145728:8aDfXHRtVR2oE76WDIJZZPlPZrbsAjHMZN1cy:86vHRtVRu7JsnN5ZfsAjsn1H

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
996	Antares Auto-Tune bundle V9 CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares Auto-Tune bundle V9 CE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares Auto-Tune bundle V9 CE.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 996	4276	Antares Auto-Tune bundle V9 CE.exe	86
PID 4276 wrote to memory of 996	4276	Antares Auto-Tune bundle V9 CE.exe	86
PID 4276 wrote to memory of 996	4276	Antares Auto-Tune bundle V9 CE.exe	86

C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe
"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\is-GHO06.tmp\Antares Auto-Tune bundle V9 CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GHO06.tmp\Antares Auto-Tune bundle V9 CE.tmp" /SL5="$B028C,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-GHO06.tmp\Antares Auto-Tune bundle V9 CE.tmp

Filesize
2.5MB

MD5
ebbb655a85d61e4adad34d9ade0ea184

SHA1
41d3a5ab6de2cd4c45bd9545906c53ba9eaf345d

SHA256
4cfcbcffe82bc6943890fa818ded2708f46c4f85ec368de00836ac708acdb080

SHA512
a84a4104356c23fa5a618368fa4ba2793435832f3eefb6b243d1513d7ac586002449f127abc6bbb3cf199a930bdd718c6d1ec273738e1d9796d423ddb312eb50

Download Submit
memory/996-6-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/996-9-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4276-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4276-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/4276-8-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download