ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe
Size

82KB
MD5

ff4ee1432e7ce0724b12c0b5962725d0
SHA1

6562d250daf92602583cf422050114b2460024c4
SHA256

ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23
SHA512

cb223b40ba0db735125f012fd37c86c9839cebe56d8ff9d64919718676e1f31b4ff4f9b5a8436c476ea5e3910520d0bffbd1e85c83e1b1df3a439fac59457ffd
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/RvDQeduJHqqnzMRDBI:ZzFbxmLPWQMOtEvwDpj386Sj/Rsoq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2372	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2836	2372	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe	30
PID 2372 wrote to memory of 2836	2372	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe	30
PID 2372 wrote to memory of 2836	2372	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe	30
PID 2372 wrote to memory of 2836	2372	ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe	30

C:\Users\Admin\AppData\Local\Temp\ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe
"C:\Users\Admin\AppData\Local\Temp\ed2dfe2748a9e10b421df165bcfbcae74b63ccd3b7b7cc232b0ddaf6edf5ee23N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
6116deeeda1a1c8a08d921d0946ca99f

SHA1
2df004bf7c84dfde2943546162bed3bd0177eac6

SHA256
3a3b7d51667372f1f2d2ebe1b463ba305ea79e5a9228e7657b3f4826f5ea5023

SHA512
eda4d650ac35aebbf956bd6d86df18551e0dbc757c865c525fa3bb8f1032867dbfb52b1e50b5b7014dc89a0ab101d9954e7a1db9dbdb591b6e269ca13ad5c858

Download Submit
memory/2372-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2372-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2372-1-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2372-3-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2836-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2836-17-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2836-18-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download