2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
Size

30KB
MD5

2973f983c8526b77f2ebef9406c0aed0
SHA1

553ea198f16aa20bd709f0428a64ffdaae66fc65
SHA256

2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38c
SHA512

1e030d2f1f2d5597b0f7b02f3e001992ac00900782df27884a0049031aeb95234452bf7dedfd03170768e1eaea277a440611dc7690f04e627cb81c4979659d56
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGo+sH:v/qSamrxDmqoKM4Z0iwtwf5

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1340	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	2024091906.exe

Loads dropped DLL 2 IoCs

pid	Process
2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024091906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
2264	2024091906.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2264	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	31
PID 2932 wrote to memory of 2264	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	31
PID 2932 wrote to memory of 2264	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	31
PID 2932 wrote to memory of 2264	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	31
PID 2932 wrote to memory of 1340	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	32
PID 2932 wrote to memory of 1340	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	32
PID 2932 wrote to memory of 1340	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	32
PID 2932 wrote to memory of 1340	2932	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	32

C:\Users\Admin\AppData\Local\Temp\2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
"C:\Users\Admin\AppData\Local\Temp\2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\2024091906.exe
  C:\Users\Admin\AppData\Local\Temp\2024091906.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
270B

MD5
4b11ad2b66efcc902de69c22289b9e5d

SHA1
dc9caaefbb8897a76a469c026ff7f2c9fe737be6

SHA256
b1f42226494f3257fa3e342f44ccbfdba7e83afb413ea5827e5e6f38ffef8f8a

SHA512
803ae71a5bceaa7655404fd5c5b911f14b32a2ba6615ebaaae3b1bb4c128f95c4c17795ecacdbda39be2c6bbcb3cd152eb5a43650ac16112950dded0e67326e7

Download Submit
\Users\Admin\AppData\Local\Temp\2024091906.exe

Filesize
30KB

MD5
0d9f079170a96e2c1e9a8cc0f0353d7d

SHA1
ad8a5de6feb872fee0dcee4b0d3fe0073fddd3d5

SHA256
9eac71da310b26a82ba868ece69a5d9ebbeb049436d04e42e3c5977854bec62e

SHA512
95b85e65f790410bd670b12fcaf52ac9834006611c81bbb31407e1a37a8c15116ec0afcf7cd25393f6f96805cc3e51a28920480430877b16fe5a019637cd9829

Download Submit
memory/2264-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download