b846237e9c624397c4674df926f04547e7058745387dd69e0f5d29f150f860b5

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 17:23 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SSA_Setup.exe
Size

907KB
MD5

4fb4126d5eea5f975519d057e4dc4a6e
SHA1

b3a33346f79aaaff115301092075ae9768fddcdd
SHA256

0a420cf9275db2a9bbc45556d4de703c79583109c73a1483f5d3656119529fee
SHA512

4849335796ab80a784f7c7c38014e4994497242c1f66edf932de48bc5648b497c4edb418fdb936ada7ba3e68a6913b2934465848f35d4d78c6aef4cf2bbb68d0
SSDEEP

24576:f20nbd14HueX8fnT2XipstF8MPTwwqegXC75ld1qSVpcqG:f2MdiHRMiipsF8ItJd1qapcqG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1564	SSA_Setup.tmp

Loads dropped DLL 2 IoCs

pid	Process
1564	SSA_Setup.tmp
1564	SSA_Setup.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA_Setup.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82
PID 4104 wrote to memory of 1564	4104	SSA_Setup.exe	82

C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp" /SL5="$70206,676464,54272,C:\Users\Admin\AppData\Local\Temp\SSA_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1564

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

136.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.32.126.40.in-addr.arpa

IN PTR

Response
DNS

83.210.23.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.210.23.2.in-addr.arpa

IN PTR

Response

83.210.23.2.in-addr.arpa

IN PTR

a2-23-210-83deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

132 B
90 B
2
1

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

136.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

136.32.126.40.in-addr.arpa
8.8.8.8:53

83.210.23.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

83.210.23.2.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-0STHS.tmp\SSA_Setup.tmp

Filesize
695KB

MD5
620f32e56b46e90e8aee43febc59f6e3

SHA1
d5edd63dd1390a1420b85f746e12a66625ae9354

SHA256
bcc9d63213012bf25a37f48015e5f755d359f3b08d05d35319b03b4a72710730

SHA512
8a9d2a2eb3891265cec379978399ad6c9b4bf3e12e0f381946b4390621b943b97fa04fbb87ad628652bd765b706eb2ff56001f24de24e9bcc487a59ca2f07d9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BS1SL.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
memory/1564-38-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-30-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-46-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-44-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-20-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-22-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-26-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-28-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-34-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-36-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-42-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1564-40-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4104-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4104-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4104-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.