d9e64fce1e55e91b4e0024da4d37294170a55dc3d83a69c05ed0f9ccaa2a1c0d

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94d2b9a2c1d6eb15412ade390183da0N.exe
Size

6.1MB
MD5

c94d2b9a2c1d6eb15412ade390183da0
SHA1

eb2796ac39c47df3582231607918a27697b0b4a2
SHA256

d9e64fce1e55e91b4e0024da4d37294170a55dc3d83a69c05ed0f9ccaa2a1c0d
SHA512

444036d744c9775e588f6f8e5633e477ec1101c39f32ec12f07d5a99592496c84818d2e07ce5d30468c2f3e6a3bea0e4df6e963ed1abd43cf53a99c6db28bd10
SSDEEP

196608:VsssssssssssssssssssssssssssssssssssssssssssdNNNNNNNNNNNNNNNNNNj:Vssssssssssssssssssssssssssssssu

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3608	svrwsc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/228-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/228-2-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/files/0x0009000000023419-5.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svrwsc.exe	c94d2b9a2c1d6eb15412ade390183da0N.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c94d2b9a2c1d6eb15412ade390183da0N.exe

C:\Users\Admin\AppData\Local\Temp\c94d2b9a2c1d6eb15412ade390183da0N.exe
"C:\Users\Admin\AppData\Local\Temp\c94d2b9a2c1d6eb15412ade390183da0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:228

C:\Windows\SysWOW64\svrwsc.exe
C:\Windows\SysWOW64\svrwsc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svrwsc.exe

Filesize
6.5MB

MD5
6e3ee5271eeb40c587c5d1f055c63fb4

SHA1
b4e8f251d2abec29049273fa24ef35d3e7a2389c

SHA256
01ee8e2666d03f5376c0e66d9216386f88be0690ffe5fd572625a5cbdff0a5ad

SHA512
b82f3da383b35ed9bae249bf683cbd0d8468e1acdb8b1c25516d9d5a0233b1e2504bec510a27fbb591894d0ebc65d9838a175fd1dab3d9a21635295c042214f0

Download Submit
memory/228-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/228-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/228-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/228-3-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/228-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3608-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download