1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874

Analysis

max time kernel
107s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
Size

428KB
MD5

42d1e563d6b3bfafb42ba0bee4337700
SHA1

771b666471678deac3c711dc9c568dae3ef6007f
SHA256

1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874
SHA512

a664df007b98c3f7cdca031cc21b9769f5bfb875618b9f2071854d956d936625bb9a49ec0c84b91ffb0f41ff20fda9c60da7810d78935a546a5118bc08cd5c81
SSDEEP

12288:Z594+AcL4tBekiuKzErTlQcJXBizs9sLC9lm/Ja2l:BL4tBekiuVrTqYRiz/ElT2

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2128	4441.tmp

Executes dropped EXE 1 IoCs

pid	Process
2128	4441.tmp

Loads dropped DLL 1 IoCs

pid	Process
2908	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4441.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2128	2908	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	30
PID 2908 wrote to memory of 2128	2908	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	30
PID 2908 wrote to memory of 2128	2908	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	30
PID 2908 wrote to memory of 2128	2908	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	30

C:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
"C:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\4441.tmp
  "C:\Users\Admin\AppData\Local\Temp\4441.tmp" --helpC:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe 43860B44EC16A8E19E72D034CB775EC2E69376A70695F795707E95DF652421C9DE90FB053C01911C66A1C4F3F3B1B2F7F8566770452B132DFFCB6847D546E959
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4441.tmp

Filesize
428KB

MD5
9182c6ee7e8ef73a8f77f5e32cfcf4a7

SHA1
4a55e73c5c2e43929fdf0dbf9cccf11df4d758e7

SHA256
ce52abc7f8ba39b24fff212f029524002a57b3adcdb44e8c6290db5ef7ed4240

SHA512
cccd84112fe5fd9ab9e3561bfd6bc002591ee999601cea267c26a36fb06f7a940b89e8b15065dbf80ece11b3e375d836d82144854bac0163a791dcd30e3af5fb

Download Submit