0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe
Size

26KB
MD5

549f226585b240bd06a09b547610ad20
SHA1

4ab4c90c45fcb4ae55346b21391544e0d34148a9
SHA256

0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1d
SHA512

42476111260cc3e80450627a73938e1c5993b4c7485d8052381af35596b4a296ea0520016f1407c489f16d0f0432077535b2c697d24e627aa27c7ec6e8585845
SSDEEP

384:Rgcx5SNj7YBqOETTITP5Dsl+AUeVn651h7iQroCuCE5NU6gZnRlGAcXq:T4j7YBkweh63h7iQroC8XtgZnRl2Xq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1068	storti.exe

Loads dropped DLL 1 IoCs

pid	Process
2384	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1068	2384	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	30
PID 2384 wrote to memory of 1068	2384	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	30
PID 2384 wrote to memory of 1068	2384	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	30
PID 2384 wrote to memory of 1068	2384	0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe	30

C:\Users\Admin\AppData\Local\Temp\0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe
"C:\Users\Admin\AppData\Local\Temp\0e6afd97958f489edf5431adf0a07da931334301d1a1e3e432ef19792bd8ab1dN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\storti.exe
  "C:\Users\Admin\AppData\Local\Temp\storti.exe"
  2⤵
  - Executes dropped EXE
  PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\storti.exe

Filesize
26KB

MD5
461e4e0ea9b9cbaa428b5daf98124926

SHA1
2d4e0124d105b44d9f402bad58146dc4c73283f4

SHA256
38ab46077fbf8251e8ace9acd7d966e9589302923ee3cc91e5d6cbf90b135f3f

SHA512
167c0516d83d8c6fe4d166bc0fbc8a3d3939f13e798322904f5872f586a8d84775d4372cc3303d7a1f6b02b74c14eb82f6fda3930ad13494322e1127905a2b17

Download Submit
memory/2384-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/2384-0-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download