5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
Size

29KB
MD5

56c425d0e4a5d02b8931d914682012f0
SHA1

28393f73d9863dac4b1775e16c04567fd45a0af6
SHA256

5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9
SHA512

dc2035514f8589cd16946be2e386eb3663cefd320e8e104d07139fbd78b7bdc2388038206b5ee8b0ae296b1c7ade3bacd1f134f82b4d903e8fb0ad89bcda5138
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXeAcq:v/qSamrxDmqoKM4Z0iwtwAKq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4500	2024092723.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024092723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
4500	2024092723.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4500	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	89
PID 1104 wrote to memory of 4500	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	89
PID 1104 wrote to memory of 4500	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	89
PID 1104 wrote to memory of 3584	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	90
PID 1104 wrote to memory of 3584	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	90
PID 1104 wrote to memory of 3584	1104	5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe	90

C:\Users\Admin\AppData\Local\Temp\5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe
"C:\Users\Admin\AppData\Local\Temp\5a9d9c5e628d740b0021700c39ee1efe188ca29cc74edc6ae3738b7c5237ede9N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\2024092723.exe
  C:\Users\Admin\AppData\Local\Temp\2024092723.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024092723.exe

Filesize
29KB

MD5
7946d855f73fe3586393012c185e54fb

SHA1
5a6ae02e039917e2a5f0b873c0e234380f10d84c

SHA256
8711a6e92a4a94d8444d90d29c2be207f7ee3e30605ecb3a5ed497a443443387

SHA512
0caf79b29f332835080876547f890ed9334020544a5e17708d4624be644f7a25fc99f9126be87af4e909eb1d5eda30cd36d2c4d673666634fc7ffe5c72eff078

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
270B

MD5
0723c1bc6cd8fd9a081a1020e3bed40f

SHA1
de8b53b28fef59a886457e40e06153c2683b3d63

SHA256
f4f644be35c57fda839b6dfa285120c78be71b42c75ba2f137a5c22ab6fa074f

SHA512
f6eaa3f435fcf8ab4695f24c889239b1ed4787f7f0087d69773bda05da708a084182673beafb30f4ced41016b041a265f7f2c33f4cff68fa60b16011cb2ff5c8

Download Submit
memory/4500-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download