806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 13.2MB
Sample240910-tryhzstfqd
SHA256 806b687095169d4ee65405782ba8527ec7f2fcd6918e3da7fa4417377e0cad3a
MD5 56c671ca2f1c447d9626235f396c870a
SHA1 3bc86393d8b3f0e20e8b49466c48c0a54a03fd61
SHA512 44e253da47ec0aa276cbe2abdf4186e9634eb81176a8a9263b48eda3f44346179a380c4b76c157c14740dcb3675dd91ffbf16a7f60accdaedaa58b74a2d313e6
SSDEEP 393216:e0qJtXxO7qhaKNDJCvTV7D3OwjdAjLnDUFXoQcnU:e/t2KNJC137dAjEFSU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2868	build_4.exe
396	build_4.exe

Loads dropped DLL 3 IoCs

pid	Process
756	WScript.exe
2868	build_4.exe
396	build_4.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0008000000018705-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 756	280	file.exe	29
PID 280 wrote to memory of 756	280	file.exe	29
PID 280 wrote to memory of 756	280	file.exe	29
PID 280 wrote to memory of 756	280	file.exe	29
PID 756 wrote to memory of 2868	756	WScript.exe	30
PID 756 wrote to memory of 2868	756	WScript.exe	30
PID 756 wrote to memory of 2868	756	WScript.exe	30
PID 756 wrote to memory of 2868	756	WScript.exe	30
PID 2868 wrote to memory of 396	2868	build_4.exe	31
PID 2868 wrote to memory of 396	2868	build_4.exe	31
PID 2868 wrote to memory of 396	2868	build_4.exe	31
PID 2868 wrote to memory of 396	2868	build_4.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build_4.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_4.exe
Size 13.1MB
SHA256 64863ef0c89a91f133ac968f1774e39c0c7fa5c69beb825b3db5e55c4ba60987
MD5 5a5d6ad84a7462708c1f4d51ad7ee9cb
SHA1 de68d6b39aef7dcd49216308110d7b1be4cbf649
SHA512 0cd56d1e7cc34bd56acebd94ee9370ec7aee90b7f86ea6234a6147480d84c4581a5fac85ce73b0cd00a7f7df5e830e4c4dca597ad037a32e84b769b369b50e22
SSDEEP 393216:qbPmYRQK7+zaDD3OhQfuSL3bMz0plnztTQCFMmKcZ:qbrRQtW6QmIAmln1QCFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 183B
SHA256 b2771d1657dde2b930007d61ff633919560d9aa7a0a07d9671c962721ed6d88d
MD5 5894fc443d20e14cf58c39182e36b005
SHA1 b499cc3083b0f78dcba99f371e03b1fba280f9f0
SHA512 f4d8459a7d81f8c7bb4c6ccdef7404032117b9423fb63613d0ad8918453f8078c2ae308ad1167cd7f7b7a409a5807307712b38f3616f6d15c394efd44a65109c
MD5 SHA1 SHA512

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\python312.dll
Size 5.6MB
SHA256 65900b1bc22af5bb974385f7f2a8742ffd12860010cbe0aedb62ff5598998414
MD5 0eac9fa387647c388fab4239bfe5a0b5
SHA1 fafb679a58b8d85b50af18a4c0a7402fa890ee39
SHA512 70042322b98681c73f83f05e03f61a8ad985944cf07633653706c9b87be738e6698099f40328058ee80d4063f8e85aba7c674c3af079cf082376fb1dc9005e86
SSDEEP 98304:LayZgZAJ43oMN/5F2/JTidHHdMyWYRw2zZ:LaWhPyFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads