39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
Size

94KB
MD5

b47f4d7038dade772ab15630dd7e2150
SHA1

aac952db70ff9dbe6fb9483f9869fbc16ef5e9da
SHA256

39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9
SHA512

16f15b18d8dd919ecd12f84310aa6083ccde19497f2b38d5025f34455f9a6753d676c77baedcd2e6ed21dd5e361c7b093354c32f2f8f3430a42359594e27ee12
SSDEEP

1536:XJuOMD3p5tCOxL4jSJxy+C6FvozfadlqKpB/SFrgUobAo+dJxEgJoM:5uOQpby2OKQzSOKp90rgUoUbrxdW

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4680	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Executes dropped EXE 1 IoCs

pid	Process
4680	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2944	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2944	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
4680	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4680	2944	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	83
PID 2944 wrote to memory of 4680	2944	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	83
PID 2944 wrote to memory of 4680	2944	39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe	83

C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
"C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
  C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39307afc6dd4836c63acffd8f79e9749c22e391d9662faeba57fad04f4c361f9N.exe

Filesize
94KB

MD5
148dfef071a59c756177c0cb4069530d

SHA1
77058e6bfc1836ae9243816d4b6ae1796fa52099

SHA256
cd39680d7442cad7dec5710f8661cab154cf5e6f62d85ba826f2da4ae1d5bc44

SHA512
fdc03e7389c270cf94e4154adfff24d97a9a2d44d70aa5f961a7551528622c9747d465878ed20b07688fd8d2828842b8ddea360404db19482ea7ee202fb0298e

Download Submit
memory/2944-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2944-1-0x0000000001560000-0x0000000001592000-memory.dmp

Filesize
200KB

Download
memory/2944-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2944-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4680-13-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4680-14-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/4680-25-0x00000000014F0000-0x000000000150B000-memory.dmp

Filesize
108KB

Download
memory/4680-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4680-26-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download