5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
Size

29KB
MD5

56c425d0e4a5d02b8931d914682012f0
SHA1

28393f73d9863dac4b1775e16c04567fd45a0af6
SHA256

5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9
SHA512

dc2035514f8589cd16946be2e386eb3663cefd320e8e104d07139fbd78b7bdc2388038206b5ee8b0ae296b1c7ade3bacd1f134f82b4d903e8fb0ad89bcda5138
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXeAcq:v/qSamrxDmqoKM4Z0iwtwAKq

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2184	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	2024092723.exe

Loads dropped DLL 2 IoCs

pid	Process
984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024092723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
1780	2024092723.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1780	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	29
PID 984 wrote to memory of 1780	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	29
PID 984 wrote to memory of 1780	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	29
PID 984 wrote to memory of 1780	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	29
PID 984 wrote to memory of 2184	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	30
PID 984 wrote to memory of 2184	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	30
PID 984 wrote to memory of 2184	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	30
PID 984 wrote to memory of 2184	984	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	30

C:\Users\Admin\AppData\Local\Temp\5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
"C:\Users\Admin\AppData\Local\Temp\5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\2024092723.exe
  C:\Users\Admin\AppData\Local\Temp\2024092723.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
270B

MD5
0723c1bc6cd8fd9a081a1020e3bed40f

SHA1
de8b53b28fef59a886457e40e06153c2683b3d63

SHA256
f4f644be35c57fda839b6dfa285120c78be71b42c75ba2f137a5c22ab6fa074f

SHA512
f6eaa3f435fcf8ab4695f24c889239b1ed4787f7f0087d69773bda05da708a084182673beafb30f4ced41016b041a265f7f2c33f4cff68fa60b16011cb2ff5c8

Download Submit
\Users\Admin\AppData\Local\Temp\2024092723.exe

Filesize
29KB

MD5
d3a814dfd27cf7b3834f00a821750cf2

SHA1
969f528be0c5dacada53ed7e9ee95f4754d8b04f

SHA256
cc7e9c634cd39b3fda910e62ca502de318c92c19f3b220ecd671dd6ac38b2c80

SHA512
d08916c81ca0adca933e9307665abbfa7b65b4decdb1534dacdaf17a377b1c9025068864707ae254d07f2ffe725c693d9a2fb8b99917f06c3d19f10529f5e7e1

Download Submit
memory/1780-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download