b7823f8837406b176431c17793b036284f4c29d964c06fb3fd02ecb58f47c8c3

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b56ce2012e726294681c08097ff41b0N.exe
Size

636KB
MD5

3b56ce2012e726294681c08097ff41b0
SHA1

ea9e78cec0ecc7d73c3a7effcf0e1b411d268862
SHA256

b7823f8837406b176431c17793b036284f4c29d964c06fb3fd02ecb58f47c8c3
SHA512

fb888fa214e0732395a44256bef51683645c5e85d39215cede06232b098ad002f67fee75c9214f8d1e6461c8a497b002ac3e3f68dd494442112ced4d239982c7
SSDEEP

12288:5LUGVQBVT3D0Fw/tN8dkmLtpHHHrh7sXD24JsSpaD3vvxmbjqcbkGOQZNNmf:GGKDz0FmcLbH1vIsD3vE5bkGRZnmf

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4144	3b56ce2012e726294681c08097ff41b0N.exe
4144	3b56ce2012e726294681c08097ff41b0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b56ce2012e726294681c08097ff41b0N.exe

C:\Users\Admin\AppData\Local\Temp\3b56ce2012e726294681c08097ff41b0N.exe
"C:\Users\Admin\AppData\Local\Temp\3b56ce2012e726294681c08097ff41b0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsuD283.tmp\System.dll

Filesize
11KB

MD5
ec539506ff2972b2743d8509420003b2

SHA1
3eb85366aef39567c8bb2c1d855137a6e1a3af90

SHA256
19227e1d2a655edb5fd419e5b9d99769ca3e8d5a3e08a549c3d21ff935b90de6

SHA512
1b79de5ae081c0ce54a26fa68db17ba19f9857cea022db0461b88983876d08d2810967336f17a06da73764f9883190eb78bf66657e0a85431fc11cad60be0de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuD283.tmp\nsDialogs.dll

Filesize
9KB

MD5
fa0c5a13e10f1b45c8719b1b428e39d1

SHA1
cfb4542c2d9f335cd4959c07b3f9f8f875663fbf

SHA256
93de321cfdbc1e71a9f7f1bc4ee1de4dd7d05696f9c96a21415c5e0e1b8f951c

SHA512
4b2314e1c6368eea13506d167e2c085c96337875dcda386a81c1badd8990519c61106e7cb6f827613dd45d69cca6f82cf1beba88685dc8be0abf3c7e8c6c010c

Download Submit