39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9

Analysis

max time kernel
79s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
Size

94KB
MD5

b47f4d7038dade772ab15630dd7e2150
SHA1

aac952db70ff9dbe6fb9483f9869fbc16ef5e9da
SHA256

39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9
SHA512

16f15b18d8dd919ecd12f84310aa6083ccde19497f2b38d5025f34455f9a6753d676c77baedcd2e6ed21dd5e361c7b093354c32f2f8f3430a42359594e27ee12
SSDEEP

1536:XJuOMD3p5tCOxL4jSJxy+C6FvozfadlqKpB/SFrgUobAo+dJxEgJoM:5uOQpby2OKQzSOKp90rgUoUbrxdW

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1712	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Executes dropped EXE 1 IoCs

pid	Process
1712	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Loads dropped DLL 1 IoCs

pid	Process
2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
1712	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1712	2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	31
PID 2072 wrote to memory of 1712	2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	31
PID 2072 wrote to memory of 1712	2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	31
PID 2072 wrote to memory of 1712	2072	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	31

C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
"C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
  C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Filesize
94KB

MD5
840fd242ff1e9c417baac45d9e3cd45f

SHA1
ff6a7f302438e23d2ac379fe89492032ef9ca321

SHA256
b01e0151a9e7e814a3ccb17b94a50c80d2a0d3b4d0968034fd43b1932f20fa69

SHA512
1d722ae40364ee7f150c205877451413a997b25b40855ec39035d918c2db45f960f544c96fef30e397177b9bfcddc59315f1a2a7c89b569e9ff140876a210831

Download Submit
memory/1712-29-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/1712-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1712-18-0x00000000001E0000-0x0000000000212000-memory.dmp

Filesize
200KB

Download
memory/1712-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1712-30-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2072-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2072-4-0x00000000001F0000-0x0000000000222000-memory.dmp

Filesize
200KB

Download
memory/2072-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2072-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download