2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38c

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
Size

30KB
MD5

2973f983c8526b77f2ebef9406c0aed0
SHA1

553ea198f16aa20bd709f0428a64ffdaae66fc65
SHA256

2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38c
SHA512

1e030d2f1f2d5597b0f7b02f3e001992ac00900782df27884a0049031aeb95234452bf7dedfd03170768e1eaea277a440611dc7690f04e627cb81c4979659d56
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGo+sH:v/qSamrxDmqoKM4Z0iwtwf5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
644	2024091906.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024091906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
644	2024091906.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 644	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	82
PID 3160 wrote to memory of 644	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	82
PID 3160 wrote to memory of 644	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	82
PID 3160 wrote to memory of 2900	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	83
PID 3160 wrote to memory of 2900	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	83
PID 3160 wrote to memory of 2900	3160	2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe	83

C:\Users\Admin\AppData\Local\Temp\2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe
"C:\Users\Admin\AppData\Local\Temp\2cb3c39fa83fe9f040601d6a89b543222bb104c19d8521ae9539a318ef4be38cN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\2024091906.exe
  C:\Users\Admin\AppData\Local\Temp\2024091906.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024091906.exe

Filesize
30KB

MD5
baccd5cfdfc87840406aed3243b83cc1

SHA1
f37f27e1855135700487cee2f25c445203918d5d

SHA256
c30d1522c0c7a652ccf4172c84e9d003ebca01077579a0d88da2bdf05937ac6a

SHA512
ef24064c959822cd148f959d02ac87fa61938c43051f04a0b1a889bb3fe9f3cbdacdc5954cefe340f60078ca1dd0efdcc5bbcfb80b87e4fc250990a20a06131d

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
270B

MD5
4b11ad2b66efcc902de69c22289b9e5d

SHA1
dc9caaefbb8897a76a469c026ff7f2c9fe737be6

SHA256
b1f42226494f3257fa3e342f44ccbfdba7e83afb413ea5827e5e6f38ffef8f8a

SHA512
803ae71a5bceaa7655404fd5c5b911f14b32a2ba6615ebaaae3b1bb4c128f95c4c17795ecacdbda39be2c6bbcb3cd152eb5a43650ac16112950dded0e67326e7

Download Submit
memory/644-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download