d281819bd940cb82c355af15093b7532bb1e019c513f555bcbb78cade3eb18f0

Analysis

max time kernel
135s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe
Size

1.9MB
MD5

3245f6adead357314b678895899e96b8
SHA1

d24d2c205ca42d22ec91ed9614f33ed0bb297ac1
SHA256

a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9
SHA512

e8558ee2637bdd4adeb30a11ef382a8eca574cf8d11791032770409ad6bd3acac32799233f87eb89524c9dc782e20c8464f9ebe1f9f264cdb2cca18d9fb27ca3
SSDEEP

49152:Qoa1taC070dQvJmAGgGPHRXMrCen4mkZu:Qoa1taC0RxmA+J0kZu

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2228	D4C5.tmp

Executes dropped EXE 1 IoCs

pid	Process
2228	D4C5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4C5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2228	3856	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	88
PID 3856 wrote to memory of 2228	3856	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	88
PID 3856 wrote to memory of 2228	3856	a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe	88

C:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe
"C:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\D4C5.tmp
  "C:\Users\Admin\AppData\Local\Temp\D4C5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a7cb6f83ff3b59d320de39428637f9222f909d07b86488fdf5e640fba6bf46a9.exe 33A43BF793A0266C3C5E37E94DCF6FFD9404B0604FFE74D716633A9E0836B96CE358A1ED5BEC9E0E94C02D7C1FFF3D04B3FE78E4FEC9949E05BC2496B1045793
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D4C5.tmp

Filesize
1.9MB

MD5
13bf8dcbbfceee56afd4d3d722525e82

SHA1
860fe3190c5de64890923042dc2b72de1ca4b426

SHA256
de2ab265fcfa0deb14f1f4bd491c0e6c82953f23fd567f5dc4aa5bf1077d579c

SHA512
dea56667a77757b16b9d4c89dde80463e869bddadf838b20b589e00615df8da7ac50080bf71684934cf83afd56fea91df0b23c476566070d57222070f10b5443

Download Submit
memory/2228-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3856-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download