65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029

Analysis

max time kernel
127s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
Size

1.5MB
MD5

04c3f2c713065a6da7648ba651943d7e
SHA1

43a7568fe4352cd803b995a14a16ef7965e231a1
SHA256

65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029
SHA512

f6914fc168b0f24dfb5734bc413a016008f924353cd4c2d167f06f48d5342dc3190125aa12e548fce8f4c7812e11239c352b900f3c7794a35e5cef6158128a25
SSDEEP

24576:FTIeLkkKmeYKUIg5bvSXPjRFmc7WeJYKUIg5bvSXPjRL:FTIPkKh4ZlcRPWeJ4ZlcRL

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4992	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Executes dropped EXE 1 IoCs

pid	Process
4992	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1988-0-0x0000000000400000-0x00000000004E0000-memory.dmp	upx
behavioral2/memory/4992-14-0x0000000000400000-0x00000000004E0000-memory.dmp	upx
behavioral2/files/0x000800000002356a-13.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1988	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1988	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
4992	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4992	1988	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	91
PID 1988 wrote to memory of 4992	1988	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	91
PID 1988 wrote to memory of 4992	1988	65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe	91

C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
"C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
  C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\65aeafdec1eb7432bea605d22738e4277d9014fdfa270b3c9e39c9a4bd592029.exe

Filesize
1.5MB

MD5
5f60c7eec62a79605820be8f863d77dc

SHA1
a498a9e22bd99d71288ccf495148c27e75d70ca7

SHA256
993cf4bbc4604c422be7a2f31bd75f0318e3695e6fa16e7ca5dfe05e092df544

SHA512
141d18a4046543ca023dc2bc903978fa8b581ef4a80597cad9af0a4929976cfd4912c554d8c883f4d33e86a38620e4924c53a1dc6251609ab81671bb46e65d31

Download Submit
memory/1988-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1988-1-0x00000000014E0000-0x0000000001511000-memory.dmp

Filesize
196KB

Download
memory/1988-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-14-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4992-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-22-0x0000000000100000-0x0000000000131000-memory.dmp

Filesize
196KB

Download
memory/4992-35-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download