Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 10:20

General

  • Target

    78023bdaf9f185ff21ad64a6af645fe56a0935c801f85731b8c3a85248e71bd4.exe

  • Size

    7.6MB

  • MD5

    0be4a2592f848a5781a73ee60fa20ba6

  • SHA1

    85bf09a2f02d66e8aa03147c90f7edd404c8a6aa

  • SHA256

    78023bdaf9f185ff21ad64a6af645fe56a0935c801f85731b8c3a85248e71bd4

  • SHA512

    84b138f38e92a6ca5614a706dc8788ba218d7f4e0dde691dab18f1b9256def36475181f456435499a183336f5a385641d7d0b7401c22d42fe6ee5116796f0530

  • SSDEEP

    98304:K0XCXkHTfN9Z+1jjw+giUMZCq6bFREzaOHSWLu4F:K0XCXkHTfN9QgirZC5YS

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78023bdaf9f185ff21ad64a6af645fe56a0935c801f85731b8c3a85248e71bd4.exe
    "C:\Users\Admin\AppData\Local\Temp\78023bdaf9f185ff21ad64a6af645fe56a0935c801f85731b8c3a85248e71bd4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1364-0-0x000000007442E000-0x000000007442F000-memory.dmp

    Filesize

    4KB

  • memory/1364-1-0x0000000000950000-0x00000000010F0000-memory.dmp

    Filesize

    7.6MB

  • memory/1364-2-0x0000000005DF0000-0x000000000609C000-memory.dmp

    Filesize

    2.7MB

  • memory/1364-4-0x0000000005D00000-0x0000000005D9C000-memory.dmp

    Filesize

    624KB

  • memory/1364-3-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1364-5-0x0000000003730000-0x0000000003752000-memory.dmp

    Filesize

    136KB

  • memory/1364-8-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1856-6-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/1856-10-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/1856-12-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/1856-9-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB