cfd27b3d61ad0cfcb0c5e31bb47144114b5ea37a7189a31bbf0c9ffa94e6f581

Resubmissions

30-09-2024 19:41

240930-yele4ssbln 10

28-03-2024 06:05

240328-gta49aef5y 7

Analysis

max time kernel
31s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe
Size

15.8MB
MD5

d3b4eacce35fb5b50b0f45f35119508c
SHA1

18ae2430f7ea7ae5e92e95ca251711a59738f31f
SHA256

edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4
SHA512

877829fc113b126094a96170a860cfbd2e54b7b1a4fecf7d21f1722922ae0183ffc7bf154b7fc6afdc6d3dc2cf4e619c72fdbb16c0444b52486042e6f1781235
SSDEEP

393216:j3JQVz1M/0XRlPzAuIhlQd5A1eT67vXUFjyO/Nk:gC0Pbxc/eTAUlymC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.tmp

Loads dropped DLL 1 IoCs

pid	Process
2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29
PID 2592 wrote to memory of 2824	2592	edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe	29

C:\Users\Admin\AppData\Local\Temp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe
"C:\Users\Admin\AppData\Local\Temp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\is-GSEQP.tmp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GSEQP.tmp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.tmp" /SL5="$30158,15648808,1044992,C:\Users\Admin\AppData\Local\Temp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-GSEQP.tmp\edaa4e44df8652613f83cab2b7790f3a8c0086fee134747747afc139e5481ad4.tmp

Filesize
3.2MB

MD5
7da27e20661e025f701f1f64927c70f8

SHA1
4d01eaaa7251e382c2b71f12af826c2575196188

SHA256
9742767b2de0c8c1305a2c3f712c76043ce6bba3f31beae7419fd64913abc3e5

SHA512
7e57d809f70844b67b0ee67ba0f2cca5ef5ee30680a9f7fd7d55a61f2cee1bfe61dbe490699955d5d94110e43bfc3f053d7ef3569788be17345d4ff4cb086019

Download Submit
memory/2592-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2592-0-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2592-10-0x0000000000400000-0x000000000050C000-memory.dmp

Filesize
1.0MB

Download
memory/2824-9-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/2824-11-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/2824-15-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download