7a9350cd5e3e621f14d38a170769b55cba0e6ab6de8f5a75d0703716030bcf22

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8502eb5c1c20d034eceabe7fd3b4dfa0N.exe
Size

30KB
MD5

8502eb5c1c20d034eceabe7fd3b4dfa0
SHA1

049f90c8391621b4688b13aba48ad2001df7a5ef
SHA256

7a9350cd5e3e621f14d38a170769b55cba0e6ab6de8f5a75d0703716030bcf22
SHA512

c144a10953cb81f8b441635807df9a74489ac1d639495c1705bbb0758bd8b00b8d5ac8c92d481d4ea6c43045fc7f6eb986588e0ee50ef3ae177cfaefe55ef82a
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXeAcw:v/qSamrxDmqoKM4Z0iwtwAKw

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2808	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	2024091410.exe

Loads dropped DLL 2 IoCs

pid	Process
2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe
2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024091410.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe
2056	2024091410.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2056	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	31
PID 2436 wrote to memory of 2056	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	31
PID 2436 wrote to memory of 2056	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	31
PID 2436 wrote to memory of 2056	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	31
PID 2436 wrote to memory of 2808	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	32
PID 2436 wrote to memory of 2808	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	32
PID 2436 wrote to memory of 2808	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	32
PID 2436 wrote to memory of 2808	2436	8502eb5c1c20d034eceabe7fd3b4dfa0N.exe	32

C:\Users\Admin\AppData\Local\Temp\8502eb5c1c20d034eceabe7fd3b4dfa0N.exe
"C:\Users\Admin\AppData\Local\Temp\8502eb5c1c20d034eceabe7fd3b4dfa0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\2024091410.exe
  C:\Users\Admin\AppData\Local\Temp\2024091410.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
174B

MD5
b8c62be39bb511a57f910148581c7176

SHA1
e8f52d337e75c505e4f23f99d6982b4c6a00748e

SHA256
290efc25a56a28f99e8d1d62e697993b1bda9b30d82b58fb58a2688a274614cd

SHA512
9b542156b730f1ba30d4627f54a5834043f6f8bb1d1088ae3ce95ab6c000fb753e2d144aaf705cb6a27012b879dec6c87399cbdc7dd33a92e13efc867bfbe059

Download Submit
\Users\Admin\AppData\Local\Temp\2024091410.exe

Filesize
30KB

MD5
850925b969704982b40f78b12231c429

SHA1
07aae7cf7d95ce33903d73208015c7eabb8bcce0

SHA256
ec70d0e845e6f1c758792c3ccca8bf1661a3de20635884d9d77148a42d93d51f

SHA512
ae890e8d57f108a1f73ad1975b7a17884fe6d22e693981546c4b127301a4b1d5e1b165739b9e09c2cd0eebd3f89f7491bee45465a4aaba548b3ad2f56ab609d2

Download Submit
memory/2056-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download