Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe
Resource
win10v2004-20240802-en
General
-
Target
eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe
-
Size
48KB
-
MD5
baad424bf4d249ea48d0b3e836fd8c30
-
SHA1
39ff88d1958b74b39a424e2441dc486773219265
-
SHA256
eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769
-
SHA512
4311c99d870db2fb079ae45cb36dbbebbda74f3c6d7d6d94fcd8dccdbda954ef49ef4f3f721a7bac9e7715b34f011b4631b5f4bda93f2eab8aa2a8e4b1452331
-
SSDEEP
1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIJ:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4052 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4052 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3448 wrote to memory of 4052 3448 eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe 82 PID 3448 wrote to memory of 4052 3448 eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe 82 PID 3448 wrote to memory of 4052 3448 eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe"C:\Users\Admin\AppData\Local\Temp\eae57275efc2d7be3a49e245d540123f21478c03d6261cb9a22ca0e9b1607769N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5403d7b07c912cd3b930063d46b61938c
SHA19d852d610c9a86f9181577a4ee7fce80ad599bf7
SHA2568328baf19035dc1b67e8a6790ec87ce9df4d10881bb23b580bd16339cccee1e8
SHA512bb6dc9c0f3dd95ffafcef3fe661ea087b1b6febde0c0f995473f56a66951c37718fd8d633aef05de9aa3cc74833e1b4b0d884bbb076812ee5cf4d8cf2fcc15c4