c16f9b0d5806e82b7e32842e78d243ecaed45ec63fb2230268a0fe9172f56172

Analysis

max time kernel
93s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/id/surveys/vbamnu.dll
Size

29KB
MD5

2e8811916b23afa369b0a1584d95086e
SHA1

6887c697e59766859cc561a751adfda3a9140e63
SHA256

687db98b6b8cf42dae4c2ea7e50e149c9b79e61bd48d5f806ebc042fb2ed09ad
SHA512

cca9270aa9782afe5291f17517cb89dce94371003af44824f5a7ed5d7efae7c8ebeac30bd58834d34783ca53fb6507b7556943b4e75bb0b1c22a90cb5b8c97a0
SSDEEP

384:VIy3T9VTvHyc/x8KmtzFCtoLKaGpQxvwMT5fy0DT1HGMAFZCap6/b/0dD0L6Kq0M:VIycKmtMt8uWp1VtHGPvKMZ0Rq0xxoX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4360	2680	regsvr32.exe	83
PID 2680 wrote to memory of 4360	2680	regsvr32.exe	83
PID 2680 wrote to memory of 4360	2680	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\id\surveys\vbamnu.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$TEMP\id\surveys\vbamnu.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads