3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe
Size

1.0MB
MD5

e42cd20204c9719bcdce776583a0a8d0
SHA1

3e5f85bf63eb61795ae50367854da992a74d126f
SHA256

3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131
SHA512

71031f4eab4e1b018e8368e62cd742aab2d2d5422e96c75156ece04ca53ccf6f410c0b02a27e50801faa2d1216243258644d97b8299ab194d3375ff479be7863
SSDEEP

24576:Gq39BcOhvmKFKVPGYe9ncpZ3rka/JS9a/ZH:z9+OhvmKFK34cv3rkgig

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2748	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2748	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2748	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2748	2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe	31
PID 2364 wrote to memory of 2748	2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe	31
PID 2364 wrote to memory of 2748	2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe	31
PID 2364 wrote to memory of 2748	2364	3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe	31

C:\Users\Admin\AppData\Local\Temp\3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe
"C:\Users\Admin\AppData\Local\Temp\3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe
  C:\Users\Admin\AppData\Local\Temp\3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3e9984911682eb6337b0e115f4e2eb5a53ca6f510951b73b52d31bfe25cc1131N.exe

Filesize
1.0MB

MD5
b57c37a3817320d53efb32f39b59f654

SHA1
24116cc5c94ab7d8ccc96a32bec675227dda9860

SHA256
84997d570347f448364a63fb50d50baeb533a9924fa1b66b46cfb6b2b14ccb19

SHA512
cce3a56e7b0b43e009d7528779d25e9c3a5c950266ff48a39ddc0315c4acc3eeb27f11398580f65608e7429cfc0ebfbe36b9e3827fb057be5a510618ba335b47

Download Submit
memory/2364-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2364-6-0x00000000031D0000-0x00000000032DD000-memory.dmp

Filesize
1.1MB

Download
memory/2364-10-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2748-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2748-13-0x0000000002E20000-0x0000000002F2D000-memory.dmp

Filesize
1.1MB

Download
memory/2748-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2748-39-0x000000000EE90000-0x000000000EF33000-memory.dmp

Filesize
652KB

Download
memory/2748-40-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download