d281819bd940cb82c355af15093b7532bb1e019c513f555bcbb78cade3eb18f0

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe
Size

1.9MB
MD5

3245f6adead357314b678895899e96b8
SHA1

d24d2c205ca42d22ec91ed9614f33ed0bb297ac1
SHA256

a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9
SHA512

e8558ee2637bdd4adeb30a11ef382a8eca574cf8d11791032770409ad6bd3acac32799233f87eb89524c9dc782e20c8464f9ebe1f9f264cdb2cca18d9fb27ca3
SSDEEP

49152:Qoa1taC070dQvJmAGgGPHRXMrCen4mkZu:Qoa1taC0RxmA+J0kZu

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2688	5ABD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2688	5ABD.tmp

Loads dropped DLL 1 IoCs

pid	Process
2648	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ABD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2688	2648	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	30
PID 2648 wrote to memory of 2688	2648	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	30
PID 2648 wrote to memory of 2688	2648	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	30
PID 2648 wrote to memory of 2688	2648	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	30

C:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe
"C:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\5ABD.tmp
  "C:\Users\Admin\AppData\Local\Temp\5ABD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe E3ED56266C65C24FC94DB4AACC5953D57462FF5D67EDE5A5474B0623539C25BDC6B52B24DBBFBDFD79436DB1C7B70981B8A5F691B65317C73AA56DB4ED35725F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5ABD.tmp

Filesize
1.9MB

MD5
738c7f752d8597cef887168724a7be73

SHA1
16177cfc1f43fde0794260f89fe97d492c483b73

SHA256
a9ba1e8e1d199cc88144f3bbf6f45419c3c635ca9e6efc06ee950af6e92cfcd8

SHA512
771a953a9485bd4b0428c6dffb2b6661fc073ae2620ea5b6d835c82e9468ef679d64bffe45f432f6632de9df261eee63bd307db6f268bc8f69aeab4b900f7b8e

Download Submit
memory/2648-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2688-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download