65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
Size

1.5MB
MD5

04c3f2c713065a6da7648ba651943d7e
SHA1

43a7568fe4352cd803b995a14a16ef7965e231a1
SHA256

65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029
SHA512

f6914fc168b0f24dfb5734bc413a016008f924353cd4c2d167f06f48d5342dc3190125aa12e548fce8f4c7812e11239c352b900f3c7794a35e5cef6158128a25
SSDEEP

24576:FTIeLkkKmeYKUIg5bvSXPjRFmc7WeJYKUIg5bvSXPjRL:FTIPkKh4ZlcRPWeJ4ZlcRL

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2136	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000400000-0x00000000004E0000-memory.dmp	upx
behavioral1/files/0x000b000000012266-17.dat	upx
behavioral1/memory/2856-16-0x0000000000310000-0x00000000003F0000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
2136	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2136	2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	31
PID 2856 wrote to memory of 2136	2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	31
PID 2856 wrote to memory of 2136	2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	31
PID 2856 wrote to memory of 2136	2856	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	31

C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
"C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
  C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Filesize
1.5MB

MD5
9d5fe7ba5f320c9a491728d217d3fb98

SHA1
0f08e308667ff44a721814b7312f6390521f8c97

SHA256
79d9b2bc7b19a2c78db9a3ede77ec1171038ed17f6657934f13e20f5b7618417

SHA512
8151c01f505b651bb929e7905482f4aab1b60d05dba72ab373204905921f13de68f5754e29b6f933358204d548539797ecf2388e95b98ab0d55f52d68e5d71ff

Download Submit
memory/2136-18-0x0000000000160000-0x0000000000191000-memory.dmp

Filesize
196KB

Download
memory/2136-42-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2856-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2856-1-0x0000000000160000-0x0000000000191000-memory.dmp

Filesize
196KB

Download
memory/2856-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2856-16-0x0000000000310000-0x00000000003F0000-memory.dmp

Filesize
896KB

Download
memory/2856-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2856-41-0x0000000000310000-0x00000000003F0000-memory.dmp

Filesize
896KB

Download