176078ab0b2859e0a5a9fe3c7e954395bf2cb6bc3ebeac55ad512287e5fd0132

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a2805f567978d1c28117d4bb9ab5f00N.exe
Size

229KB
MD5

1a2805f567978d1c28117d4bb9ab5f00
SHA1

43f4dd9f902bf2c8c1df7c3b0df893a056fcd972
SHA256

176078ab0b2859e0a5a9fe3c7e954395bf2cb6bc3ebeac55ad512287e5fd0132
SHA512

69171ca61f6e5efab2f9bb28b215a31d1c34b2dc6c0c28a0876cba1796cea6874effde2a68fb3a1ec0cf15d292742478d33a1a5f6e9c8ae6452b98795d48fdd0
SSDEEP

3072:tZIOGNITH2noS7Nnkpk6scwrjRXIx+j9QQXZ1qijbS2jbxWGqJsd:HcNxoS7Nnkpk6scwrtNXZouSbGqJ+

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2180	ndribzb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ndribzb.exe	1a2805f567978d1c28117d4bb9ab5f00N.exe
File created	C:\PROGRA~3\Mozilla\fyggpme.dll	ndribzb.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a2805f567978d1c28117d4bb9ab5f00N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndribzb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3048	1a2805f567978d1c28117d4bb9ab5f00N.exe
2180	ndribzb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2180	1980	taskeng.exe	30
PID 1980 wrote to memory of 2180	1980	taskeng.exe	30
PID 1980 wrote to memory of 2180	1980	taskeng.exe	30
PID 1980 wrote to memory of 2180	1980	taskeng.exe	30

C:\Users\Admin\AppData\Local\Temp\1a2805f567978d1c28117d4bb9ab5f00N.exe
"C:\Users\Admin\AppData\Local\Temp\1a2805f567978d1c28117d4bb9ab5f00N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:3048

C:\Windows\system32\taskeng.exe
taskeng.exe {14EE6068-0FA4-4CDC-A008-E9FA40B8F808} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\PROGRA~3\Mozilla\ndribzb.exe
  C:\PROGRA~3\Mozilla\ndribzb.exe -eciltya
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\ndribzb.exe

Filesize
229KB

MD5
d5f21fbe278388f55e29d89b15db0b8f

SHA1
0b3485f023e8118effa80f42963f58d770bce25e

SHA256
592b36a49e882b261937ec61699cd70827f9beb58913885197ec48b081471b85

SHA512
d60a633f194087539764541edb1e32db5a23fe937ee0c4c31464789789d8a53e116e06bca6767acdcc83df950855d7a1925571acec6feb3446ca9ea4b0199702

Download Submit
memory/2180-7-0x0000000000250000-0x00000000002AC000-memory.dmp

Filesize
368KB

Download
memory/2180-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2180-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2180-11-0x0000000000250000-0x00000000002AC000-memory.dmp

Filesize
368KB

Download
memory/3048-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-2-0x0000000000250000-0x00000000002AC000-memory.dmp

Filesize
368KB

Download
memory/3048-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download