67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe
Size

336KB
MD5

f4c39548ce38af473df5f667f15994b0
SHA1

a2d630d4f16b37494ed28b202a0d91c37340da7a
SHA256

67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008
SHA512

4dfdf64cf85a2677db931e3775e8727f96dfe574816fef960cb19fc88cfe8e640a115b8fedfa64cab9991708fbc811d05517f49dcfc4772210912e9aa5cde7ca
SSDEEP

6144:qAfm+U/B8atwqaCvZx+ty3NAbCHXGAiTmZF0OUKhuOZw6WBnnJZBsgE:lfml8FqGAWd8

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3464	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Executes dropped EXE 1 IoCs

pid	Process
3464	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4580	4216	WerFault.exe	81
460	3464	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4216	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3464	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3464	4216	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe	86
PID 4216 wrote to memory of 3464	4216	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe	86
PID 4216 wrote to memory of 3464	4216	67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe	86

C:\Users\Admin\AppData\Local\Temp\67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe
"C:\Users\Admin\AppData\Local\Temp\67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 396
  2⤵
  - Program crash
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe
  C:\Users\Admin\AppData\Local\Temp\67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 372
    3⤵
    - Program crash
    PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4216 -ip 4216
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3464 -ip 3464
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67bbb47f57ac0ace8f5bf608a1b872d02081ede422b2c6c2524b10ad48a24008N.exe

Filesize
336KB

MD5
53d208fc5cee1f39f4e7898ac92ff87e

SHA1
ab115a2a6c0f962a1db7cd0d57337f0d3e765d98

SHA256
b74e536d2e1d0e6f9d8e2c5c19c99324258316af0c5ddf7fbea27a2e47f6cbc8

SHA512
40f45fa0fa4b3a02fa09a750a99cc6eb4ed5734b86a89e832dea1b532dc52771a33eddc3b60ebfeef0fb5da5dd21e7ff16b43593b5c9de305ae5b498ae7ff48f

Download Submit
memory/3464-8-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3464-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3464-14-0x0000000004E00000-0x0000000004E54000-memory.dmp

Filesize
336KB

Download
memory/3464-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4216-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4216-7-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download