cde50d16f497914f7529c44fc67841b48cac49a67e0101215888f55f828f7101

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e88eb456e78a7099f677e69053ec1390N.exe
Size

7.8MB
MD5

e88eb456e78a7099f677e69053ec1390
SHA1

be9292410c5a55403872345a552bdb10fdde7b51
SHA256

cde50d16f497914f7529c44fc67841b48cac49a67e0101215888f55f828f7101
SHA512

1aafddd6c87cadf31aa58807cefe46e7aa925d5f1843da7e86fa2bd70f9f3beba3df60c44403d29342b5ea07658b28256f9cb759c7294db32e221ec4d466a63f
SSDEEP

98304:emhd1Uryes0xITRQggxvR1gkrS51V7wQqZUha5jtSyZIUb:ellrpxDVe512QbaZtli

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1260	6060.tmp

Executes dropped EXE 1 IoCs

pid	Process
1260	6060.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e88eb456e78a7099f677e69053ec1390N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6060.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 1260	3968	e88eb456e78a7099f677e69053ec1390N.exe	86
PID 3968 wrote to memory of 1260	3968	e88eb456e78a7099f677e69053ec1390N.exe	86
PID 3968 wrote to memory of 1260	3968	e88eb456e78a7099f677e69053ec1390N.exe	86

C:\Users\Admin\AppData\Local\Temp\e88eb456e78a7099f677e69053ec1390N.exe
"C:\Users\Admin\AppData\Local\Temp\e88eb456e78a7099f677e69053ec1390N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Users\Admin\AppData\Local\Temp\6060.tmp
  "C:\Users\Admin\AppData\Local\Temp\6060.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e88eb456e78a7099f677e69053ec1390N.exe A8CCC2BAE4B0D57A0E72AA0C45F5AA1D211993FB0C40AFA755FC390CD77648C4A752793CD950A23B3E829FA50E68639309B9CCF5A6DECDE7196A8AF6ABABA7A2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6060.tmp

Filesize
7.8MB

MD5
b5989256e2a6caf22f6f53da9c860042

SHA1
11dbed60ba241c74c089c042d71c9fccb42df229

SHA256
e36723dc1e671c33b8d1c858603fda0338ff202b074915dfefd00c2df26dc272

SHA512
8d2f318f5cbb98a145c70e53fafdb1f06a1d1dcc10b0bfa506086aad6a16e7af0524c637ba7878af8308dc0b3c93ff15515ae508d61f81b0008ddaa8ae4ae7a4

Download Submit
memory/1260-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/3968-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download