9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
Size

690KB
MD5

d5168fa56597cb77291f154e2bb71290
SHA1

d7802371dc0bd2f393a08baf7be44b3eee5093b9
SHA256

9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec
SHA512

0e0c5044abe92e569e89c57716973c5bc190e0d1018cfe6ee737b6bf44d57d8eb67bfbef05eb1c60013295bb345ca87c3fd776ace72d87918ade45dd63981d44
SSDEEP

12288:ypa9nNno8GFIJGMEohM74pYmCtFrOVUelPaBVvZ:+annoRFIJ2frOVUelPaBVvZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3732	fzu3z9gzcmdrosm7n7t.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
628	ibthkedtqql.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	ibthkedtqql.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	bypuxusa.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	ibthkedtqql.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
File created	C:\Windows\sqmwvhb\o2ykuydhvrbc	fzu3z9gzcmdrosm7n7t.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzu3z9gzcmdrosm7n7t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibthkedtqql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypuxusa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4804	ibthkedtqql.exe
4804	ibthkedtqql.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe
4648	bypuxusa.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3732	1604	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	82
PID 1604 wrote to memory of 3732	1604	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	82
PID 1604 wrote to memory of 3732	1604	9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe	82
PID 4804 wrote to memory of 4648	4804	ibthkedtqql.exe	84
PID 4804 wrote to memory of 4648	4804	ibthkedtqql.exe	84
PID 4804 wrote to memory of 4648	4804	ibthkedtqql.exe	84
PID 3732 wrote to memory of 628	3732	fzu3z9gzcmdrosm7n7t.exe	85
PID 3732 wrote to memory of 628	3732	fzu3z9gzcmdrosm7n7t.exe	85
PID 3732 wrote to memory of 628	3732	fzu3z9gzcmdrosm7n7t.exe	85

C:\Users\Admin\AppData\Local\Temp\9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe
"C:\Users\Admin\AppData\Local\Temp\9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ecN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\sqmwvhb\fzu3z9gzcmdrosm7n7t.exe
  "C:\sqmwvhb\fzu3z9gzcmdrosm7n7t.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\sqmwvhb\ibthkedtqql.exe
    "C:\sqmwvhb\ibthkedtqql.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:628

C:\sqmwvhb\ibthkedtqql.exe
C:\sqmwvhb\ibthkedtqql.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804
- C:\sqmwvhb\bypuxusa.exe
  kkwlrhuu9dp9 "c:\sqmwvhb\ibthkedtqql.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\sqmwvhb\fzu3z9gzcmdrosm7n7t.exe

Filesize
690KB

MD5
d5168fa56597cb77291f154e2bb71290

SHA1
d7802371dc0bd2f393a08baf7be44b3eee5093b9

SHA256
9f0d349e57d4bfa2c8c17cbabde3df7ee811ca52918288fbc3f4bd10052b12ec

SHA512
0e0c5044abe92e569e89c57716973c5bc190e0d1018cfe6ee737b6bf44d57d8eb67bfbef05eb1c60013295bb345ca87c3fd776ace72d87918ade45dd63981d44

Download Submit
C:\sqmwvhb\inarztdy2

Filesize
4B

MD5
21429f54af94a3b300cb292db6102c7e

SHA1
6f01faad1b5df665a747a265d50b5a87334a3938

SHA256
4ba982516e515946219858f62a8e95b84537735eca467aa99776bdff324a6756

SHA512
c68e12e7aec87c1ea5fe6df2644fb144dd18defe441985d788b1273867823d484fe98409d27c0737c42deea999ac22bc686ee2f09619155bb1062929849049c5

Download Submit
C:\sqmwvhb\o2ykuydhvrbc

Filesize
8B

MD5
edb1f70651c9d35bb14495337935871b

SHA1
4369e603353ec363aa969b6276f3b001d60d3a10

SHA256
687c3742849a25fcc5821cc08d5235dad186f228cdf4010f27d803750a262f6e

SHA512
1d939eec826facd0a755bd9b08e12cbf5af39dd45bdf7f9bb1ad89e049fb26b38c063d154eebd796388ad14f072bf1e6668b57111e1c3aaa175a1e8a267a610c

Download Submit