364ed8c05d46a75359f907e62439702c312ad51c3c0cbf5ad22d90841c57bf94

Analysis

max time kernel
95s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe
Size

1.9MB
MD5

e6bcddd428bf856a460f2eb3c0182592
SHA1

98502a1f3f08e0c26e01f4b08a9cc5098f3cc651
SHA256

66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9
SHA512

03b743c6963a95dacdddb4535ecdb51128cbf91407207f7852d22183087178d2b0bb0be31b51d3cb382e603a55715adfa949402b46c53592772dd580a7668bc7
SSDEEP

49152:Qoa1taC070dTXHaDUDGgkR7E6eBEZuGJVP9EVdSVm:Qoa1taC0iX6DALkh6wusP9eMm

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3700	D476.tmp

Executes dropped EXE 1 IoCs

pid	Process
3700	D476.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D476.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3700	4504	66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe	88
PID 4504 wrote to memory of 3700	4504	66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe	88
PID 4504 wrote to memory of 3700	4504	66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe	88

C:\Users\Admin\AppData\Local\Temp\66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe
"C:\Users\Admin\AppData\Local\Temp\66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\D476.tmp
  "C:\Users\Admin\AppData\Local\Temp\D476.tmp" --splashC:\Users\Admin\AppData\Local\Temp\66efda891ddfde42904bdce17571af1015b023af4dcb6b0222b5a980dcb1c4d9.exe D17DDA9C368A7CF336B148EFD42ED4EC593926545072D689B01F3EC20213FBF116A5FB9B2ED8939047875100A0958D85F5BF0F0EF53DC27D19FD0BD570B7A551
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D476.tmp

Filesize
1.9MB

MD5
3a4b764a3f7edfa85f7874b16b00d47e

SHA1
9ff8760a1e76439de6cff28b747e89f3dc25fa0c

SHA256
b6f9fbdbd0c6f7041e8dcdcc7c86434c9052f3b6942351d252d4e10d43a03ca5

SHA512
e0e37c9f4f355f842cb1e74e817cad795c7dbfcbe724b598fc5db085ce45960fe471354e7c5391139182175f60d5a3f5bf059d4a77fe3c18abd1603aced68709

Download Submit
memory/3700-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4504-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download