Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 08:21

General

  • Target

    16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22bN.exe

  • Size

    674KB

  • MD5

    7df27f2393a810ad347b5245f322d7e0

  • SHA1

    4697bec339cca075a94c1bc1bb6460d40380b0b9

  • SHA256

    16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22b

  • SHA512

    5b92001f58dc7fdcfed465440071df9265cdf0df4e7af28043f1a52d636d528f8829a3c597e73215854e476dd6f26b6a9e20ce7357b31e7e42a26a788031ee79

  • SSDEEP

    12288:nxaUxWthICHeZaKdOI9XgoG/GDuOhUTl6H8BRZ2NPR20VFpEJpd91XQXqoOdtTJ:nxBSIC+ZaKvX5GEzgRZ2NPoYeJP91XQd

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22bN.exe
    "C:\Users\Admin\AppData\Local\Temp\16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22bN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22bN.exe
      "C:\Users\Admin\AppData\Local\Temp\16d5d876e7cafd91607abf2b687a05b9d814949915485af9de83ecc5d483a22bN.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 184
        3⤵
        • Program crash
        PID:4876
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4716 -ip 4716
    1⤵
      PID:3244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2324-8-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2324-9-0x00000000066D0000-0x000000000675E000-memory.dmp

      Filesize

      568KB

    • memory/2324-2-0x00000000052D0000-0x0000000005874000-memory.dmp

      Filesize

      5.6MB

    • memory/2324-3-0x0000000004D20000-0x0000000004DB2000-memory.dmp

      Filesize

      584KB

    • memory/2324-4-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/2324-5-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

      Filesize

      40KB

    • memory/2324-1-0x0000000000250000-0x00000000002FE000-memory.dmp

      Filesize

      696KB

    • memory/2324-6-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/2324-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

      Filesize

      4KB

    • memory/2324-7-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

      Filesize

      4KB

    • memory/2324-10-0x0000000008D50000-0x0000000008DEC000-memory.dmp

      Filesize

      624KB

    • memory/2324-13-0x0000000074B00000-0x00000000752B0000-memory.dmp

      Filesize

      7.7MB

    • memory/4716-11-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

    • memory/4716-14-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

    • memory/4716-15-0x00000000010C0000-0x000000000140A000-memory.dmp

      Filesize

      3.3MB

    • memory/4716-16-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB