11fe7a13ad470ff3c39423f1ebb5b7abff8cf8a656d2ac97c0183d680d07687c

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4e5ccd35a56d84281a143f831563be.exe
Size

24.0MB
MD5

1a4e5ccd35a56d84281a143f831563be
SHA1

d3748dd01572d9c8e8dfd655186f8c32d97de414
SHA256

321502845d1c6bae83addd564ff6db1b92e9d5722865795daf9cd66cd3a9d39f
SHA512

7a79f5d4a440643ab49c68ca038601bb7dc53449e2355f4a1391b92d921ef4778611853ec94aef30b7b89f794ee0c5ee387cde680c6ad1ecff2cc37658aa6c0e
SSDEEP

393216:rpzfSFU1OYrLM3NRivs3r401VvVRdqjxccJhLctQ7Lq2qMbX7Gs3RIoK1phuVHwQ:N+FU1n3+Rik3r4oVtRdOxcEhUrwXn3Rd

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

1a4e5ccd35a56d84281a143f831563be.exe

pid process

2308 1a4e5ccd35a56d84281a143f831563be.exe
2308 1a4e5ccd35a56d84281a143f831563be.exe
2308 1a4e5ccd35a56d84281a143f831563be.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

1a4e5ccd35a56d84281a143f831563be.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a4e5ccd35a56d84281a143f831563be.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1a4e5ccd35a56d84281a143f831563be.exe

pid process

2308 1a4e5ccd35a56d84281a143f831563be.exe

pid	process
2308	1a4e5ccd35a56d84281a143f831563be.exe
2308	1a4e5ccd35a56d84281a143f831563be.exe
2308	1a4e5ccd35a56d84281a143f831563be.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a4e5ccd35a56d84281a143f831563be.exe

pid	process
2308	1a4e5ccd35a56d84281a143f831563be.exe

C:\Users\Admin\AppData\Local\Temp\1a4e5ccd35a56d84281a143f831563be.exe
"C:\Users\Admin\AppData\Local\Temp\1a4e5ccd35a56d84281a143f831563be.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoAC95.tmp\ButtonEvent.dll

Filesize
4KB

MD5
55788069d3fa4e1daf80f3339fa86fe2

SHA1
d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96

SHA256
d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f

SHA512
d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616

Download Submit
\Users\Admin\AppData\Local\Temp\nsoAC95.tmp\System.dll

Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
\Users\Admin\AppData\Local\Temp\nsoAC95.tmp\nsDialogs.dll

Filesize
12KB

MD5
2029c44871670eec937d1a8c1e9faa21

SHA1
e8d53b9e8bc475cc274d80d3836b526d8dd2747a

SHA256
a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2

SHA512
6f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7

Download Submit
memory/2308-17-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2308-19-0x0000000075150000-0x000000007515E000-memory.dmp

Filesize
56KB

Download
memory/2308-18-0x0000000075160000-0x000000007516B000-memory.dmp

Filesize
44KB

Download