Overview
overview
7Static
static
5.Net_Frame...up.exe
windows10-1703-x64
7Data/0/1/2.../1.exe
windows10-1703-x64
7Data/0/1/2...ck.dll
windows10-1703-x64
1Data/0/1/2...ta.dll
windows10-1703-x64
1Data/0/1/2...fo.exe
windows10-1703-x64
3Data/0/1/2...sw.bat
windows10-1703-x64
1Data/Data.rar
windows10-1703-x64
3KMS_pic0-setup.exe
windows10-1703-x64
4KMS_pic0-setupz.bat
windows10-1703-x64
4Password.txt
windows10-1703-x64
1Video Tutorials.mp4
windows10-1703-x64
6info.exe
windows10-1703-x64
3reginfo.ps1
windows10-1703-x64
3Analysis
-
max time kernel
1800s -
max time network
1579s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-09-2024 05:15
Static task
static1
Behavioral task
behavioral1
Sample
.Net_Framework_v4.0_Full_setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Data/0/1/2/3/4/5/6/7/8/9/1.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Data/0/1/2/3/4/5/6/7/8/9/check.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Data/0/1/2/3/4/5/6/7/8/9/data.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Data/0/1/2/3/4/5/6/7/8/9/info.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Data/0/1/2/3/4/5/6/7/8/9/msw.bat
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Data/Data.rar
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
KMS_pic0-setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
KMS_pic0-setupz.bat
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Password.txt
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Video Tutorials.mp4
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
info.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
reginfo.ps1
Resource
win10-20240404-en
General
-
Target
Data/0/1/2/3/4/5/6/7/8/9/1.exe
-
Size
3.1MB
-
MD5
a02164371a50c5ff9fa2870ef6e8cfa3
-
SHA1
060614723f8375ecaad8b249ff07e3be082d7f25
-
SHA256
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
-
SHA512
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326
-
SSDEEP
98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4396 1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2216 wrote to memory of 4396 2216 1.exe 74 PID 2216 wrote to memory of 4396 2216 1.exe 74 PID 2216 wrote to memory of 4396 2216 1.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\Data\0\1\2\3\4\5\6\7\8\9\1.exe"C:\Users\Admin\AppData\Local\Temp\Data\0\1\2\3\4\5\6\7\8\9\1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\is-B77OK.tmp\1.tmp"C:\Users\Admin\AppData\Local\Temp\is-B77OK.tmp\1.tmp" /SL5="$901EC,2952592,69120,C:\Users\Admin\AppData\Local\Temp\Data\0\1\2\3\4\5\6\7\8\9\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD51778c1f66ff205875a6435a33229ab3c
SHA15b6189159b16c6f85feed66834af3e06c0277a19
SHA25695c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
SHA5128844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0