0aa296b20732f620b607bfbbc249fa144ca4cd33b24dc6a0e210b859c271bd34

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ElitePingReducer.exe
Size

31.5MB
MD5

b85479a19ec4743194eeb9d5f6e0af83
SHA1

5b9bc90e2dc7915a42a17ec01db4a01a8b4ff688
SHA256

0aa296b20732f620b607bfbbc249fa144ca4cd33b24dc6a0e210b859c271bd34
SHA512

f4f8a66dfa029e98d9ab4abf2ae853368ba99b81f72d8005efbc1ca15aa4db3529e2be0641bc8e9d66af942b8a1f6a16a0cdb8cce37efc2a2bf63341eab621c5
SSDEEP

786432:V6uFL8UPJzC171c9teAsDEJgFI9Z79qPe+MZsWgnFM3Hch:bFL8MJG1+9tnsDEJzKd2iNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2964	ElitePingReducer.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ElitePingReducer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ElitePingReducer.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4996	ElitePingReducer.exe
2964	ElitePingReducer.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2964	4996	ElitePingReducer.exe	88
PID 4996 wrote to memory of 2964	4996	ElitePingReducer.exe	88
PID 4996 wrote to memory of 2964	4996	ElitePingReducer.exe	88

C:\Users\Admin\AppData\Local\Temp\ElitePingReducer.exe
"C:\Users\Admin\AppData\Local\Temp\ElitePingReducer.exe"
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\is-NH03K.tmp\ElitePingReducer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NH03K.tmp\ElitePingReducer.tmp" /SL5="$60244,32134322,794112,C:\Users\Admin\AppData\Local\Temp\ElitePingReducer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-NH03K.tmp\ElitePingReducer.tmp

Filesize
3.1MB

MD5
fd13e55c486e88ff387b4eecfc71922d

SHA1
e8dcc7ed94eb351889040b2d3cc5d7ca293e711c

SHA256
7164f44e856350df98bf0df78069820036353d99a0692523187338e9d0226457

SHA512
46c3f636eac2844b889d78ec449766b9c0ea4d9f2cbe44cf86edf3e3145b50925c9fa712d351f66ea3aa6aaa0164dec299795b39c9e16cf10f378720e000d6b9

Download Submit
memory/2964-6-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2964-10-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2964-9-0x0000000000810000-0x0000000000B3F000-memory.dmp

Filesize
3.2MB

Download
memory/4996-1-0x0000000000D40000-0x0000000000E10000-memory.dmp

Filesize
832KB

Download
memory/4996-2-0x0000000000D41000-0x0000000000DE9000-memory.dmp

Filesize
672KB

Download
memory/4996-8-0x0000000000D40000-0x0000000000E10000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads