98636755633560832c7621a4b85f08553f513c0eee2ad21cc277044349b17075

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 13.2MB
Sample240910-tryhzstfqe
SHA256 98636755633560832c7621a4b85f08553f513c0eee2ad21cc277044349b17075
MD5 89c2a0024c8fb9afe5a54592354c56af
SHA1 b025c8d428f4e33f6de7ea0151f0ef5b5babc89f
SHA512 62e1bf2198f0d50b23c89f0154bdeffe8b5fbabd841cb4bf32bd9777ad07173e9b4c4eb4ab2b52bbdad31097b9543e1ab0247c58cce42c0480611cb3c33d3252
SSDEEP 393216:LTwC3d3ZurVpI+Jww5YDn2R6sJXnOO0CHJmQya4S4I9:LTFdL+2wq729JX/0CHY49
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2856	build_3.exe
2884	build_3.exe

Loads dropped DLL 3 IoCs

pid	Process
2204	WScript.exe
2856	build_3.exe
2884	build_3.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0009000000016ae9-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2204	2604	file.exe	29
PID 2604 wrote to memory of 2204	2604	file.exe	29
PID 2604 wrote to memory of 2204	2604	file.exe	29
PID 2604 wrote to memory of 2204	2604	file.exe	29
PID 2204 wrote to memory of 2856	2204	WScript.exe	30
PID 2204 wrote to memory of 2856	2204	WScript.exe	30
PID 2204 wrote to memory of 2856	2204	WScript.exe	30
PID 2204 wrote to memory of 2856	2204	WScript.exe	30
PID 2856 wrote to memory of 2884	2856	build_3.exe	31
PID 2856 wrote to memory of 2884	2856	build_3.exe	31
PID 2856 wrote to memory of 2884	2856	build_3.exe	31
PID 2856 wrote to memory of 2884	2856	build_3.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_3.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_3.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_3.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build_3.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\build_3.exe
Size 13.1MB
SHA256 9bf4addec6787aef2292e1f9dad3172c2495605d67f26554fb696e5d17b7e4f3
MD5 b543ea03b1260c29849e083bc5f9d804
SHA1 9171c26503db121d16493bf8f25ec1dee6ddfaeb
SHA512 653f8ad835c05016b360794948b9d0b488fa898b2c8cf360f940b1d4c48d897cd437ed8676a2a5c604c29d5709bd3e83015ea97af6ad6115c22e3b1c6c8e9ce7
SSDEEP 393216:ObPmYRQK7+zaDD3OhQfuSL3bMz0plnztTQCFMmKcZ:ObrRQtW6QmIAmln1QCFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 183B
SHA256 a65c3f6bbbf207e375f5447c8659816eac91fd037bc51216ca9d835bd1d9696d
MD5 5dc3410c1c8528893ccd4b4e993c1632
SHA1 30cf9868b2943518a7a9c48fb7778252420840e3
SHA512 bb8e2f563ddaa2b260f311171e822d025394f7a8f860d138bfcdc1742493fecc1117b380ce78b76fccfc1b781cdf15ae2bf1d579fd4b061c08019f341b3a0582
MD5 SHA1 SHA512

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28562\python312.dll
Size 5.6MB
SHA256 65900b1bc22af5bb974385f7f2a8742ffd12860010cbe0aedb62ff5598998414
MD5 0eac9fa387647c388fab4239bfe5a0b5
SHA1 fafb679a58b8d85b50af18a4c0a7402fa890ee39
SHA512 70042322b98681c73f83f05e03f61a8ad985944cf07633653706c9b87be738e6698099f40328058ee80d4063f8e85aba7c674c3af079cf082376fb1dc9005e86
SSDEEP 98304:LayZgZAJ43oMN/5F2/JTidHHdMyWYRw2zZ:LaWhPyFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads