4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe
Size

56KB
MD5

8882cd508db89d4f4439dd15d7b136a0
SHA1

f21ebf68e11db5892befe307dd36372f5ec96998
SHA256

4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7a
SHA512

4f2c58fde9b629c7b4cb3905ff8b27d72dc51602e2dec95107ef022d6a7b676cfad0a97c02b96efd30735ea480a2ea7ede6819615e41869b84e9d07c2815afd2
SSDEEP

768:zQz7yVEhs9+syJP6ntOOtEvwDpjFeV0ZOfcp6:zj+soPSMOtEvwDpj4ym

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000700000001211b-15.dat	upx
behavioral1/memory/2232-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1756-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2232-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2232	1756	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe	29
PID 1756 wrote to memory of 2232	1756	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe	29
PID 1756 wrote to memory of 2232	1756	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe	29
PID 1756 wrote to memory of 2232	1756	4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe	29

C:\Users\Admin\AppData\Local\Temp\4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe
"C:\Users\Admin\AppData\Local\Temp\4f2430823ff67284a732b8eadbfc4a94fc27a8310cc5ebbd0218b6db6acf9f7aN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
d2ac86706c316f2497abd7348777b9de

SHA1
38c8bf7275ae6502f576505506cd329bad69313e

SHA256
95d9157d282e9ac734f90db248f226edd88c92d2a8d3167fb77ffde973f32eb7

SHA512
2056828f059c4a403886f727a7aa25b333acccf3461024c9ac22063af0301706218b95e226e597b34a54d94976bc64586f65f30aed69227f6b03e2d0b1cf1e89

Download Submit
memory/1756-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1756-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1756-3-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1756-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1756-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1756-14-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2232-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2232-26-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2232-19-0x00000000020B0000-0x00000000020B6000-memory.dmp

Filesize
24KB

Download
memory/2232-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download