6310e7be2afbbf4cfbf288f9b6c94767aebcfdb4ffea0588b0760e67940b1d5e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-audio-converter.exe
Size

2.7MB
MD5

941b271f27118557bfeaa875a7e1a71f
SHA1

16e9f0cd5818cc6248c6e1525d87734cfda40f30
SHA256

11dcfecf0b4e8e1c14853fc91cafbcbcbb3c5f3f074b94ee98961bcda399d35e
SHA512

8baf72560d67401183659c6360d30755631d6ad5e5a2ab9172565c1babcccdd4da81a36205a62fc0319908cf282d50385734d656b630250a5c094d6df97be646
SSDEEP

49152:6nzHYtC0POT6rWu7JUI0sWO86WgIvel32PGA3L/kC+kiMHVbMUkbgKg1q:OHiD866I0pY1Ivel0GAb/ew5MHAq

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1908	x-audio-converter.exe
1908	x-audio-converter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x-audio-converter.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	x-audio-converter.exe

C:\Users\Admin\AppData\Local\Temp\x-audio-converter.exe
"C:\Users\Admin\AppData\Local\Temp\x-audio-converter.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdB00F.tmp\LangDLL.dll

Filesize
4KB

MD5
68a2bc20e9033d7d592c0e3db9b1c9a7

SHA1
48f32201f29d897164f4328b3358cca659262597

SHA256
7b5874ea96afe034b0d8a529ced3e97e12d712e9d1d2cb591b82bbce59105db3

SHA512
52283afd58e88b43364c99652cb3d94e8f59dba223aa3c2f5a858e6baf108bfcf99283a7e1f09728bf293f255077620b9a025bbf3ac09d4b22c7b37ea023e648

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB00F.tmp\System.dll

Filesize
9KB

MD5
7c6ca559a1d642f47a9e2b81278d959a

SHA1
eed9a82720a45d9ab4d00cd1ae3df4054a3a840e

SHA256
63452806080ded2721ee3b6c20e677b923fa0a8e684d3a39cc8219e1c5f70c19

SHA512
98c74ae0d05f6a12072431fde97105995fd6ef143270deec2b381c5b6dd3e717097c8c9547090e949d0f55943a44bf641c3a9c076ee073359c7a2b3db917b5aa

Download Submit