9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
Size

6.7MB
MD5

51a6af40e91813aafc36f890cb44bda9
SHA1

cd65c7f89dddccb68b8a78fda7a5b3d07231bd4b
SHA256

9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e
SHA512

2b0fac71206a79fb5e2130c49f42cc42f45ac5b322e514f97633ed744bb5e129a7c48775f54c5cdf8430bed707cc1d37ae714cd4f6245c72e66fef6666810528
SSDEEP

196608:LIrS5A5nMK9G9D+QP3aDG5GGnOk1CPwDv3uF0jaRCiBrqW4D203tx:LIrSad9G9D+QiDfGnOk1CPwDv3uFwans

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
2160	9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe

C:\Users\Admin\AppData\Local\Temp\9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe
"C:\Users\Admin\AppData\Local\Temp\9ad435b1532535b6f5cfcdbfa172d7405c6d426319677e5800b1d6f8d8a7573e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll

Filesize
1.7MB

MD5
e9888362828d6b6f6e13e6cfa5a36419

SHA1
f097e4cc95f40012af1143ff345ba39180dfd32b

SHA256
37cc65da464443f780ba555ed3c86f5f1003ccbe790f85f3a612c62741c9fa92

SHA512
175487a2d5abd4c16054541e9954d909092107e254dc49d5a48fda1b7182d6cc6618d338855cd67432a85d57bf1224baeed3822a2f7b6442aca2a0ed9a124241

Download Submit
\Users\Admin\AppData\Local\Temp\libssl-1_1.dll

Filesize
353KB

MD5
2e13693945236594078a2e7c4fd029be

SHA1
b06f79529790acefedc4019d905b2a31cdb5d3e9

SHA256
e9cedb410df5a475a08b2f17ec5ea5615d02ff4f1a1e045f53053a73da9a2474

SHA512
127f3d276b7a53d724db4f316454df5436e68631089eb2e0eec706d49bf373f76619de1f089f15ed0a89e78d9baa8364145afee4242e5804803d2bc8487ed4d8

Download Submit
memory/2160-0-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2160-7-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/2160-8-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2160-10-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/2160-9-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download