fbf5ff8c1b1172aac1df0d721934ae87456362bfb6cbdbb384acf7062e1d8af3

Analysis

max time kernel
80s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f1c5b8813aa413e895450ed33e8eaa0N.exe
Size

162KB
MD5

4f1c5b8813aa413e895450ed33e8eaa0
SHA1

71514371550b1310314c1811f05ded6442cc2bd9
SHA256

fbf5ff8c1b1172aac1df0d721934ae87456362bfb6cbdbb384acf7062e1d8af3
SHA512

5b8f6fe2682857a36e091911c1e6b54aafc4f13436370e36d0e6d66b7da0423dd1c7fb46b6d6e4c33f19a72d58141b93441240017950541453ab3da52905581e
SSDEEP

3072:sADU60DJHur2q5BAV6y871oooN7U1eAlMl12MVaVZwhU9jvNVw9GDoqeVISSHR7Q:sVdHEGvFA6TJsshGDw9ygAHR7rs

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2708	4f1c5b8813aa413e895450ed33e8eaa0N.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	4f1c5b8813aa413e895450ed33e8eaa0N.exe

Loads dropped DLL 1 IoCs

pid	Process
2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f1c5b8813aa413e895450ed33e8eaa0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe
2708	4f1c5b8813aa413e895450ed33e8eaa0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2708	2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe	31
PID 2452 wrote to memory of 2708	2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe	31
PID 2452 wrote to memory of 2708	2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe	31
PID 2452 wrote to memory of 2708	2452	4f1c5b8813aa413e895450ed33e8eaa0N.exe	31

C:\Users\Admin\AppData\Local\Temp\4f1c5b8813aa413e895450ed33e8eaa0N.exe
"C:\Users\Admin\AppData\Local\Temp\4f1c5b8813aa413e895450ed33e8eaa0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\4f1c5b8813aa413e895450ed33e8eaa0N.exe
  C:\Users\Admin\AppData\Local\Temp\4f1c5b8813aa413e895450ed33e8eaa0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4f1c5b8813aa413e895450ed33e8eaa0N.exe

Filesize
162KB

MD5
96b17210098dd19d4a65bbe8501db68d

SHA1
48b5c209ee38c6e62745e14c06e9308469beaa3c

SHA256
2472fce476bf841c4b2293c3ff7bf0d89158305c429849dc0d561229dc677496

SHA512
48c484b269b1e5180df2a7cd66407da5735451cb7b7910b6af8f9783c4c016e1e953243c3d2b50a369fe50f4cf012e0349df7c1c56c3c8b9021feedcc5bcc79d

Download Submit
memory/2452-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2452-9-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/2452-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2452-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2708-22-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2708-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2708-29-0x00000000001A0000-0x00000000001BB000-memory.dmp

Filesize
108KB

Download
memory/2708-28-0x0000000000140000-0x000000000016E000-memory.dmp

Filesize
184KB

Download
memory/2708-30-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download