938d00f7eb6e1dbb8bd942e1d6b5acf9c2a98379a1d247319504888227dc4ccd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe
Size

1.9MB
MD5

9a572c8f37f9158978248735d5f3ddf2
SHA1

0e1fd94394b4b0a14b5e0ff9fc4c7176e4d6aff1
SHA256

0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d
SHA512

a9ee3653f91dd08397015ebfef477292f1e4ec56426c841ad4a6bc6d2c9abc62ab7cc9a6a4a1999da49f5b266119844c6cda606c9b31091237538ca29fe9e666
SSDEEP

49152:Qoa1taC070dIaW2ap+hKfdh/g9D/Fi+/Mi6:Qoa1taC0zhp6Kfdhg9D/0h5

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2480	BD56.tmp

Executes dropped EXE 1 IoCs

pid	Process
2480	BD56.tmp

Loads dropped DLL 1 IoCs

pid	Process
1620	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BD56.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2480	1620	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe	30
PID 1620 wrote to memory of 2480	1620	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe	30
PID 1620 wrote to memory of 2480	1620	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe	30
PID 1620 wrote to memory of 2480	1620	0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe	30

C:\Users\Admin\AppData\Local\Temp\0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe
"C:\Users\Admin\AppData\Local\Temp\0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\BD56.tmp
  "C:\Users\Admin\AppData\Local\Temp\BD56.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0edbd070bcba2eda9c929b08570fe7b982ee53b947ee633ce40abbda2936df2d.exe 72091B7480D12BB34C61C0CA0D7E97680D4BBF4DAF9FACDFEE779EBB5465069E4072F22074AFF694BE91E20BB1B4A5D0D05B0D3E95379D8C03E816BED68F260C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\BD56.tmp

Filesize
1.9MB

MD5
74708ff85c000f35d3b0721c50737e07

SHA1
f81dff2eac4bacaeb1961c29c8736cf3626560db

SHA256
06c087780e31c9ce6cf7703a9cac46b50d441c9a4a6b083feaf4dc7b98d3ebf1

SHA512
303f7f8c2bdf554463ce6a8d4487b4a5bebbefa89611e0dfe258f07a779a3412328f2bcc25284badb274f32020657c2bc7601fe11fd217d5c827217320166dbd

Download Submit
memory/1620-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2480-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download