9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec

Analysis

max time kernel
119s
max time network
90s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
Size

690KB
MD5

d5168fa56597cb77291f154e2bb71290
SHA1

d7802371dc0bd2f393a08baf7be44b3eee5093b9
SHA256

9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec
SHA512

0e0c5044abe92e569e89c57716973c5bc190e0d1018cfe6ee737b6bf44d57d8eb67bfbef05eb1c60013295bb345ca87c3fd776ace72d87918ade45dd63981d44
SSDEEP

12288:ypa9nNno8GFIJGMEohM74pYmCtFrOVUelPaBVvZ:+annoRFIJ2frOVUelPaBVvZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2752	fzu4ag894mdrosm7n7t.exe
2872	ibthkedtqql.exe
1928	bypuxusa.exe
2296	ibthkedtqql.exe

Loads dropped DLL 5 IoCs

pid	Process
2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
2872	ibthkedtqql.exe
2872	ibthkedtqql.exe
2752	fzu4ag894mdrosm7n7t.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	ibthkedtqql.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	bypuxusa.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	ibthkedtqql.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	fzu4ag894mdrosm7n7t.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibthkedtqql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypuxusa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzu4ag894mdrosm7n7t.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	ibthkedtqql.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe
1928	bypuxusa.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2752	2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	30
PID 2880 wrote to memory of 2752	2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	30
PID 2880 wrote to memory of 2752	2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	30
PID 2880 wrote to memory of 2752	2880	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	30
PID 2872 wrote to memory of 1928	2872	ibthkedtqql.exe	32
PID 2872 wrote to memory of 1928	2872	ibthkedtqql.exe	32
PID 2872 wrote to memory of 1928	2872	ibthkedtqql.exe	32
PID 2872 wrote to memory of 1928	2872	ibthkedtqql.exe	32
PID 2752 wrote to memory of 2296	2752	fzu4ag894mdrosm7n7t.exe	33
PID 2752 wrote to memory of 2296	2752	fzu4ag894mdrosm7n7t.exe	33
PID 2752 wrote to memory of 2296	2752	fzu4ag894mdrosm7n7t.exe	33
PID 2752 wrote to memory of 2296	2752	fzu4ag894mdrosm7n7t.exe	33

C:\Users\Admin\AppData\Local\Temp\9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
"C:\Users\Admin\AppData\Local\Temp\9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\sqmwvhb\fzu4ag894mdrosm7n7t.exe
  "C:\sqmwvhb\fzu4ag894mdrosm7n7t.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\sqmwvhb\ibthkedtqql.exe
    "C:\sqmwvhb\ibthkedtqql.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2296

C:\sqmwvhb\ibthkedtqql.exe
C:\sqmwvhb\ibthkedtqql.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872
- C:\sqmwvhb\bypuxusa.exe
  kkwlrhuu9dp9 "c:\sqmwvhb\ibthkedtqql.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\sqmwvhb\inarztdy2

Filesize
4B

MD5
ce4890795ad9c8cf7e204ed5acc9820e

SHA1
9f570c487cd1d44e9e60c897d04f8d7743ccb443

SHA256
ecbe718a2fefb8039d127380f73c98cca1b9f6ed21ae722c8b0d5c2dbc4d3799

SHA512
dcdd038d60ed356e6461c23e20704441be908263abfad5955eb6cfb92bbedd763b974dea00f46d34801961a9701606063da539aebfbe2fadb94811e6e90ebdf1

Download Submit
C:\sqmwvhb\o2ykuydhvrbc

Filesize
8B

MD5
edb1f70651c9d35bb14495337935871b

SHA1
4369e603353ec363aa969b6276f3b001d60d3a10

SHA256
687c3742849a25fcc5821cc08d5235dad186f228cdf4010f27d803750a262f6e

SHA512
1d939eec826facd0a755bd9b08e12cbf5af39dd45bdf7f9bb1ad89e049fb26b38c063d154eebd796388ad14f072bf1e6668b57111e1c3aaa175a1e8a267a610c

Download Submit
\sqmwvhb\fzu4ag894mdrosm7n7t.exe

Filesize
690KB

MD5
d5168fa56597cb77291f154e2bb71290

SHA1
d7802371dc0bd2f393a08baf7be44b3eee5093b9

SHA256
9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec

SHA512
0e0c5044abe92e569e89c57716973c5bc190e0d1018cfe6ee737b6bf44d57d8eb67bfbef05eb1c60013295bb345ca87c3fd776ace72d87918ade45dd63981d44

Download Submit