8d3d9ce1b3e08ab581bcd31de3adb141fb14cbe243382276c884e8bdb6ce8780

Analysis

max time kernel
100s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe
Size

1.9MB
MD5

786b61f13137975aac320352ac1da101
SHA1

ecd5117bd0da34138951c3008a295963c90cf2f0
SHA256

36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71
SHA512

48600b23dc5e0afff65f7d34e5a8c90d67c9f6b7a45a1b1b85f7042325c9a45058258cdaaf4d0c89343a4e628f136e240b5b6fc9477c142b149a785a8ba19cc6
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10d0O8Y7jN5mlFPUsMDZ79zDDlcuciP0VqEd+tS:Qoa1taC070dvh7jaqd79DDlcuFekd/fe

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2280	AF99.tmp

Executes dropped EXE 1 IoCs

pid	Process
2280	AF99.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AF99.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2280	3600	36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe	86
PID 3600 wrote to memory of 2280	3600	36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe	86
PID 3600 wrote to memory of 2280	3600	36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe	86

C:\Users\Admin\AppData\Local\Temp\36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe
"C:\Users\Admin\AppData\Local\Temp\36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\AF99.tmp
  "C:\Users\Admin\AppData\Local\Temp\AF99.tmp" --splashC:\Users\Admin\AppData\Local\Temp\36d941217ee042aa70e5d103afb8e9040bc388c5ee6140822997366b94429d71.exe D5FE00B646E1FB28440A16CA44BAD42C7D299AB4454AC4E770CDA30008E108916360723C0F43C6ABB5484D264EDF675DF124B6835E3A634C6112481F6A213D5B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AF99.tmp

Filesize
1.9MB

MD5
ee1f4b9a51b5f2ec7d7b5c53de77365a

SHA1
032d4cd5748c1c6533b9c83f70f873bb3942d59e

SHA256
3d10bb08801b0fec5de4836f0d2d701e8bb50d55855e1334e22e9a838995066f

SHA512
8f916605770661b0c5a1d02e1ee1da2f4174085c1c7ccae3ed34eb1c2402e5136db4fb67ce1dbc4c63fbdb8fceedb271c4e57d60eef71e7d98600215f017e82f

Download Submit
memory/2280-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3600-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download