1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
Size

428KB
MD5

42d1e563d6b3bfafb42ba0bee4337700
SHA1

771b666471678deac3c711dc9c568dae3ef6007f
SHA256

1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874
SHA512

a664df007b98c3f7cdca031cc21b9769f5bfb875618b9f2071854d956d936625bb9a49ec0c84b91ffb0f41ff20fda9c60da7810d78935a546a5118bc08cd5c81
SSDEEP

12288:Z594+AcL4tBekiuKzErTlQcJXBizs9sLC9lm/Ja2l:BL4tBekiuVrTqYRiz/ElT2

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
996	9725.tmp

Executes dropped EXE 1 IoCs

pid	Process
996	9725.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9725.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 996	4080	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	82
PID 4080 wrote to memory of 996	4080	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	82
PID 4080 wrote to memory of 996	4080	1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe	82

C:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe
"C:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\Temp\9725.tmp
  "C:\Users\Admin\AppData\Local\Temp\9725.tmp" --helpC:\Users\Admin\AppData\Local\Temp\1890126876c0f94bdc99955ae196b08152439eeda3471670fe8547d8b6743874N.exe 629E1B878466876975B044E120F3EB7BC86E49056D9ABA9B04590AA0B4449B47430CFB5A9D167001C35407EC8DF22FC48D70C39DA06130A245E13BB9C98F2076
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9725.tmp

Filesize
428KB

MD5
4324143d5423058cb7192c026072f08f

SHA1
c4119834934fd46cf187a54d2811d78f724ac8ad

SHA256
4878813482f9380ff43d9ec30b29b95f87a8e88003d73510e3a30c961d93932a

SHA512
5a2178eaba0e7b85698b01728e4b56e6bb73001557cc582db110aa44c36c36e3292e24fb09716f0d00fc8e62f04c514023f15ded2564b6d8d6917191417da1df

Download Submit