e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516

General

Target

e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
Size

4.8MB
MD5

2a08ca983680ad439d98756535513411
SHA1

3152c17517d5c323b953cc911361ee624000a921
SHA256

e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516
SHA512

5efa776f1e487604e8a2d0bbe7537711c6bc55770105ef87872534af51ebd9789ba3c64bcd08e3ba377bf89197e310e8dbaf3f21a89a2b8b727fa3dcb11b8215
SSDEEP

98304:9wTiwnweoDZtwF4OH8qN34a/FHNb0HSfoA9xpX+KD+Bl:9iiwnCAfWadHNb0H2xpTDg

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31
PID 332 wrote to memory of 2668	332	e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe	31

C:\Users\Admin\AppData\Local\Temp\e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
"C:\Users\Admin\AppData\Local\Temp\e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe
  "C:\Users\Admin\AppData\Local\Temp\e5274fc064364f5945b849fb8bd574da0c3a28d16431a036b9ca94c395b01516.exe"
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qxzlfomd5.tmp

Filesize
108B

MD5
be475171ec619a7fe595e19c2c5c24d0

SHA1
607ac5e88677a4f5038a7a984d75651a30fd6cbb

SHA256
260a117a1c5efcab4ba9ea51fd06a2b7bc90c2d42133f2f8967f2a4dab520ac1

SHA512
94c802c323894c1edf149b4f454b55242738fe6005078c53720dd986773c0769aebcb0dc61f473c9a1a45daa071b90d99f26c003b470b09805f4952094318c87

Download Submit
\Users\Admin\AppData\Local\Temp\MBX@14C@2521A68.###

Filesize
2KB

MD5
4d1e9f58332fc772261b15ef80d96c11

SHA1
fdcd271c3733c6a40aa17f36cc85001055eba656

SHA256
b184edfb7fc196237780ae3b2e4052657e62939946b963ff0d77cfc498eb380b

SHA512
ac35f0b5fb5627f37e5518a1654d1186edfb3523c838bc8a36b827219a522042ff9dc8a1bb60c1bf90deb68ab49b408d9ed2c352949cf4c65d8598b85be301d6

Download Submit
memory/332-20-0x0000000000401000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/332-22-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/332-4-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/332-7-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/332-6-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/332-8-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/332-0-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/332-5-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/332-21-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/332-31-0x0000000000401000-0x00000000005D0000-memory.dmp

Filesize
1.8MB

Download
memory/332-30-0x0000000004D40000-0x0000000005120000-memory.dmp

Filesize
3.9MB

Download
memory/332-29-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/332-28-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/332-27-0x0000000010000000-0x0000000010141000-memory.dmp

Filesize
1.3MB

Download
memory/2668-33-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing