8a9598dee0a5f5d86e7e0677056fdcdbc4834d9ba38a28a9c30336387b1f0a30

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Download_Energy.exe
Size

5.1MB
MD5

96a9c13cdb1c931c8d232dddf929a6ac
SHA1

7f29702918924cd1b9bd943fa0eaafecaeab4c75
SHA256

468eca855754732e658ac1d2ac677a9105f5c62580989f53295e6827232dfc68
SHA512

97dba7c1dd0f8a2bcd3afe92730f20d0171126e1ae0cd1f2218cbb91d0caae298b90bf7950733ff8c7a42daa8b5a747d7c9e00045a0ff73697b2a7bf66c11dd3
SSDEEP

98304:MHopKHIn2zDWnuL0uKVFWM1fYPSM03CNl4rDWd4u3czc1exjMtbQt:UCyDWuL0uKPWYfxn3CNk4eitG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2768	GLBEC71.tmp

Loads dropped DLL 3 IoCs

pid	Process
3052	Download_Energy.exe
2768	GLBEC71.tmp
2768	GLBEC71.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLBEC71.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Download_Energy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLBEC71.tmp

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\C:\Users\Admin\AppData\Local\Temp\INSTALL.LOG	GLBEC71.tmp
File created	C:\C:\Users\Admin\AppData\Local\Temp\INSTALL.LOG	GLBEC71.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31
PID 3052 wrote to memory of 2768	3052	Download_Energy.exe	31

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Download_Energy.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Download_Energy.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\GLBEC71.tmp
  C:\Users\Admin\AppData\Local\Temp\GLBEC71.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$PLUGI~1\DOWNLO~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLBEC71.tmp

Filesize
70KB

MD5
12457304fe66ac4b06e940451a476d0f

SHA1
5d2b4dead64e175c7f8a66d9a3e0f4f1c0796e9c

SHA256
6fd48e58a9904869fc4edc94817ce771d3aee46f5e4558bab99c432afd1dc8ce

SHA512
cb947b259d42704252c61658d75998c651272855878552831a20d79e6f4838b2f0d78af14b03e7f575638fa7e38259d87fb01d23856d020b5fbdb134e7a54be1

Download Submit
\Users\Admin\AppData\Local\Temp\GLCEC90.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
\Users\Admin\AppData\Local\Temp\GLKECA1.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit