Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
738425db464c99cdb4b909549679eca0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
738425db464c99cdb4b909549679eca0N.exe
Resource
win10v2004-20240802-en
General
-
Target
738425db464c99cdb4b909549679eca0N.exe
-
Size
225KB
-
MD5
738425db464c99cdb4b909549679eca0
-
SHA1
2e10cbaa13f3bb43a57d38a821ea3139f0f39453
-
SHA256
271ed794cfeb4e80ce97893d4d53fe85f8c7653693f3be3e2c7264cc4effec90
-
SHA512
bef52251e9a60563ae5c3105021111d8ad74b7c97a6df0e677cee67a0e345d817353f6a2267911d1f1df70d6194126a9d986c382e931b530ceb846c0543c02c9
-
SSDEEP
6144:8A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:8ATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\4A0E8658 = "C:\\Users\\Admin\\AppData\\Roaming\\4A0E8658\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 738425db464c99cdb4b909549679eca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe 2724 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1388 wrote to memory of 2724 1388 738425db464c99cdb4b909549679eca0N.exe 31 PID 1388 wrote to memory of 2724 1388 738425db464c99cdb4b909549679eca0N.exe 31 PID 1388 wrote to memory of 2724 1388 738425db464c99cdb4b909549679eca0N.exe 31 PID 1388 wrote to memory of 2724 1388 738425db464c99cdb4b909549679eca0N.exe 31 PID 1388 wrote to memory of 2724 1388 738425db464c99cdb4b909549679eca0N.exe 31 PID 2724 wrote to memory of 1196 2724 winver.exe 21 PID 2724 wrote to memory of 1072 2724 winver.exe 18 PID 2724 wrote to memory of 1132 2724 winver.exe 19 PID 2724 wrote to memory of 1196 2724 winver.exe 21 PID 2724 wrote to memory of 280 2724 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1132
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\738425db464c99cdb4b909549679eca0N.exe"C:\Users\Admin\AppData\Local\Temp\738425db464c99cdb4b909549679eca0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2724
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:280