1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe
Size

8.6MB
MD5

c8f24570bd0c702a9619de2db3f1e930
SHA1

6a37d3d19d8769c2050b4396241214aab04aeab9
SHA256

1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292f
SHA512

3b45eaaabfa21c3eb3a9901bb6d73205704898fcc6993765b12c1b8e0299ab8bab6d146f1d145beb1072a4dab35ca926baa30fbaf0ad899084bd9294a6b13752
SSDEEP

196608:bIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIF:p

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	svrwsc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1552-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/1552-2-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/files/0x0009000000023473-6.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svrwsc.exe	1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe

C:\Users\Admin\AppData\Local\Temp\1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe
"C:\Users\Admin\AppData\Local\Temp\1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1552

C:\Windows\SysWOW64\svrwsc.exe
C:\Windows\SysWOW64\svrwsc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svrwsc.exe

Filesize
8.8MB

MD5
c55c94b7a50eb56f164b5365756a28f7

SHA1
93787ceec2e5bfe87a891095d3f66488fc9652f9

SHA256
452cf773fcecc57fac585cff781457781c27e4c4bb4dfb9004853d6e1b7a8017

SHA512
5a6f13172ed36ad655a39ff4444eeddbfa35c6fe3563cdd6c4a671994779d7e7cb82f944eaf840b1dd546f84530f4a40119dbdfca16e26ae423c9f4b183ff83f

Download Submit
memory/1552-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1552-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1552-3-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1552-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1552-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2420-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download