d362096c7225a85535d4906598b56ee1de9032674e4ce7b7c0c88c75e8b8cc50

General

Target

050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
Size

756KB
MD5

9d63af72c2df9470c45dc067551c9d67
SHA1

5922dfca45e6695de0094158fd5f90deeed68fd3
SHA256

050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe
SHA512

f63ad142ca73974384eac7f1959a7636873b254525ced1a8350e6eaf0fe6ce7faa95c01247c5529f935dd22e5402eed7b4a07c8916c6a77ff974ff4dceb14d66
SSDEEP

12288:9A13CxBdOj7J1CmEIqUoyL7YDNFtkyjz7LXgFZy1XnZdWlgz59:9GyxBYj7C9hwLStkyHwOTke

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1744	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	29
PID 1508 wrote to memory of 1744	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	29
PID 1508 wrote to memory of 1744	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	29
PID 1508 wrote to memory of 1744	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	29
PID 1508 wrote to memory of 1296	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	30
PID 1508 wrote to memory of 1296	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	30
PID 1508 wrote to memory of 1296	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	30
PID 1508 wrote to memory of 1296	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	30
PID 1508 wrote to memory of 2268	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	31
PID 1508 wrote to memory of 2268	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	31
PID 1508 wrote to memory of 2268	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	31
PID 1508 wrote to memory of 2268	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	31
PID 1508 wrote to memory of 2272	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	32
PID 1508 wrote to memory of 2272	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	32
PID 1508 wrote to memory of 2272	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	32
PID 1508 wrote to memory of 2272	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	32
PID 1508 wrote to memory of 2160	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	33
PID 1508 wrote to memory of 2160	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	33
PID 1508 wrote to memory of 2160	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	33
PID 1508 wrote to memory of 2160	1508	050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe	33

C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
"C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
  2⤵
  PID:2268
- C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
  2⤵
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\050e6ec6548815c54e532f8004c7257e9bec51833e7cfcf2a38185eb48d72ffe.exe"
  2⤵
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-3-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/1508-2-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-1-0x00000000003B0000-0x0000000000474000-memory.dmp

Filesize
784KB

Download
memory/1508-0-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/1508-4-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/1508-5-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-6-0x00000000054C0000-0x000000000554E000-memory.dmp

Filesize
568KB

Download
memory/1508-7-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing