d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe
Size

8.5MB
MD5

807ffef397eacf85462ee49270822a50
SHA1

000ffe879737a2f41f56f3cc6f0aa760268e3720
SHA256

d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cb
SHA512

033236c2c1f2e8597132eb6858f2fa1f4d4fb73355299bdf2d7860831238fff94df515a13553505c85e707099a36b4f690e60f11aa20085315f085281409012a
SSDEEP

196608:WLcs/QcdiTOjrTAC19IxjRfcUM5LiQIKbJWr1IbFm:Xs/oTO31ixjRfcH5LB2mb4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1676	d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe
1676	d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe
1676	d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe

C:\Users\Admin\AppData\Local\Temp\d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe
"C:\Users\Admin\AppData\Local\Temp\d22ac0b35f2ed10a9b7a60d69470ced46b56f035a0539f4d92cde07218c3c7cbN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd95DB.tmp\StartMenu.dll

Filesize
10KB

MD5
18e0d3949bd0d1a9f45dbee66ab2ebcf

SHA1
cb32adac5ffbd82dd550989bd7fe990f71cf9b99

SHA256
372dc5534980d79d4e20147fd8d7bb20e76d91cad3d086cc1ed7bd03bd581a78

SHA512
c41b35df327933f4ba9218b326dead3724049676df5cda0a0f7f57b28b92a7efde3832af262a96d545db5e1f7e01a1191f1b68b395c592d64fdbcae80273ae45

Download Submit
\Users\Admin\AppData\Local\Temp\nsd95DB.tmp\System.dll

Filesize
26KB

MD5
ebf5c733481e2f6ddaa04fab99553616

SHA1
7a979fa5609dd29315089c8640fabf3ca01be51d

SHA256
3b7ae06666fb4277974766409349d0f14d4358e15a20c6c078a29c6021b4a779

SHA512
37a61a13ca08bcd0c7bf84c0d1ec4c4d7320b57d60fa702a1c06f8e2a5a8a9c16b4b6756147357713ffafe26dea9ed42f45e5279c4999121a5589f1069760d8c

Download Submit
\Users\Admin\AppData\Local\Temp\nsd95DB.tmp\nsDialogs.dll

Filesize
12KB

MD5
87cdd064d650b3cf72f8a103bd73bace

SHA1
f8ea12681f5a5bb97ad9b525ef12e88fda832f8a

SHA256
a29754f0b21fbb92265f1fb924b3423a330704bbf56796da67aeca876dbd3326

SHA512
6ef757c6e8ad737a3755d0e387c60b596b2261ae10d02b293c1da2c1732901079a00d7f8a5fdb203f8cf984b2d8dfcaac99a43fb8ac011eaab85b56270223a88

Download Submit
memory/1676-16-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1676-18-0x00000000744D0000-0x00000000744DE000-memory.dmp

Filesize
56KB

Download
memory/1676-17-0x00000000744E0000-0x00000000744EA000-memory.dmp

Filesize
40KB

Download
memory/1676-27-0x00000000744C0000-0x00000000744CA000-memory.dmp

Filesize
40KB

Download
memory/1676-24-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download