13f041149d2b3c0067d48d94f8b3452274f4d9e8eb6b68b4d91cf2fed3d4ba21

Analysis

max time kernel
93s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe
Size

1.9MB
MD5

bfe1c894b35a5cb3873b94edfc4e6a42
SHA1

5cf894bdeb4cca43bc6513789d76f0bfeeedff4f
SHA256

42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2
SHA512

48e14b7571ee5dce1c5aada9aa197b0439503ebddb93e80b729aa686e591583812d7534259c86de9e91fa101987e61e237d83dba27ea15143c5948d862e75684
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dJJD8SSx9De70KToSrWN8QXsyeD2wdGrc1uJn:Qoa1taC070dnCxdRKcKu8QcyFxcyn

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3240	6A43.tmp

Executes dropped EXE 1 IoCs

pid	Process
3240	6A43.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A43.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3240	4944	42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe	86
PID 4944 wrote to memory of 3240	4944	42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe	86
PID 4944 wrote to memory of 3240	4944	42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe	86

C:\Users\Admin\AppData\Local\Temp\42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe
"C:\Users\Admin\AppData\Local\Temp\42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\6A43.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A43.tmp" --splashC:\Users\Admin\AppData\Local\Temp\42053e867b30f0287d40148b3f0bc495d281dfe896e4367cab9c024c22f4b3e2.exe C4D8B5D27D3195F9A6F59B43F3D9E245066877EB21C90C3132A86D169BEDAD7AD839E9066D417C92D74478CD9232984ED06152C686928B6A5E6BAC6F63DEC213
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6A43.tmp

Filesize
1.9MB

MD5
daacb845ed480c77bb2e5fe1314f20b0

SHA1
06a8477b86034be158120421482267c839b62671

SHA256
ebbcb565ce16437a05611e3ae518d29aad7017f9ae97177c0c52e783e2a6ad09

SHA512
9f61995f434f3326e2999b3dc90b359f36a7513cbe95fd8bb7d106f8d8f4fdc5e51364d3f759a8faf228f66250eec2290ac10540933a45e0105e2e0209c1470b

Download Submit
memory/3240-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4944-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download