Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 05:44

General

  • Target

    d4c8a3819b2059058dd8a62885f70d40N.exe

  • Size

    3.0MB

  • MD5

    d4c8a3819b2059058dd8a62885f70d40

  • SHA1

    72f02df2f8165189721bd2a10bb5b614c9b265b4

  • SHA256

    1d85c77ca084345fb0746d17b71c2da66cbd7b87c8c385b05ca205525d058dd8

  • SHA512

    c42c229b59de9de3fe4b05476213f9ab4b479f3ab2e91d78c11c506fe1cfce8c17633bd56bdbdff1ebe15a976935601aa769eef9da220abd9a0fa8f7a33034e1

  • SSDEEP

    98304:Xgk4gyY1nreB41lPyO37TLN1aavvKScI1iBXwJ8:XgkXyYpyB43PLvAXU8

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4c8a3819b2059058dd8a62885f70d40N.exe
    "C:\Users\Admin\AppData\Local\Temp\d4c8a3819b2059058dd8a62885f70d40N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy5793.tmp\ioSpecial.ini

    Filesize

    702B

    MD5

    7d68b30d0794d168b9ebde75d3c6948a

    SHA1

    c0eb68d12b54adfa94aad80ef5faf9d293f6e2c6

    SHA256

    a998600ad47a5f57dcad25272ee9d35a8507395b9965f26811a17f25bd221db6

    SHA512

    bee75d6c953df0476653f085dc57dfe22ec8b89647de69dbf002210324300b9276103537c8c1cfac19bd45391338677ab6f1d2e54e0fb66358b953f418922dc8

  • \Users\Admin\AppData\Local\Temp\nsy5793.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    4c7d97d0786ff08b20d0e8315b5fc3cb

    SHA1

    bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c

    SHA256

    75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84

    SHA512

    f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a

  • \Users\Admin\AppData\Local\Temp\nsy5793.tmp\System.dll

    Filesize

    9KB

    MD5

    e085476805e8f5ef1c7ed635c5309017

    SHA1

    609e79fdc29d6dee40cc5dd333094db5f9f63eec

    SHA256

    4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67

    SHA512

    082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f