52984d792bb0fc6b530a989ef1c8389506fccf669e9a902597c135a42ff201f4

Resubmissions

16-09-2024 21:04

240916-zw13kazcpf 10

16-09-2024 20:09

240916-yw8xqsxenb 10

Analysis

max time kernel
141s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-09-2024 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

utweb_installer.exe
Size

1.7MB
MD5

adb84780e2db2c3643975b76ad57bba9
SHA1

76d1b85e91f0aa8e322669429c1f638dba807b65
SHA256

52984d792bb0fc6b530a989ef1c8389506fccf669e9a902597c135a42ff201f4
SHA512

94572f68fba6f085b5936fd0827cb6b3ffaa480d9473e26f87122443743aec797f312e73fe6a827db9e645edef06f8a44a27c09d39f354ccf14485fe242322fe
SSDEEP

24576:F7FUDowAyrTVE3U5FtFB5xG7wUTgNUYrT0TWmsMFZ2DzcbIZY4:FBuZrEUHB5xmc7Tl7c14

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	utweb_installer.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2696	3328	utweb_installer.exe	81
PID 3328 wrote to memory of 2696	3328	utweb_installer.exe	81
PID 3328 wrote to memory of 2696	3328	utweb_installer.exe	81

C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\is-NVB24.tmp\utweb_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NVB24.tmp\utweb_installer.tmp" /SL5="$A0220,866469,820736,C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-NVB24.tmp\utweb_installer.tmp

Filesize
3.0MB

MD5
f42b1291691376a98c20625f829c1a5e

SHA1
0b98aeade794181a47729b7b29e0ed70d00d0976

SHA256
e1ccfad48263ba87b4a720a76226fa515c5e628e3e1bbd6a2ef0be10a2c18e4b

SHA512
0f16e1ad93d7fdb2b90564c6d355c81ee9d0ef79a267f87fbe413d4756ac3119ad7dba3e2b037692a32e2716832e57b62afa9975388b15f120007db513b9f2fd

Download Submit
memory/2696-6-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/2696-13-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/3328-0-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/3328-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3328-11-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download