98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe
Size

92KB
MD5

fb29ef4c1d8502279111243f6d7c7700
SHA1

dc823a105d419b49751fb9859d0aea835c2c49fa
SHA256

98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662e
SHA512

f028e66ff2c082e035ca1ba9da22753cb48567dc115d4f180e9667f18cca3c36e48b9f56cfd474821fc37c7281f8f813d6dee055578f9664de1b9e09368da105
SSDEEP

1536:BS1u/J3dXiuophq/iiOxwg+DPsSfPvMDyyQxLf9NNHYArKIera:BzRVinphq/ii4wHLso0yLNf54ArKIera

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1924	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Executes dropped EXE 1 IoCs

pid	Process
1924	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Loads dropped DLL 1 IoCs

pid	Process
2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe
1924	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1924	2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe	31
PID 2532 wrote to memory of 1924	2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe	31
PID 2532 wrote to memory of 1924	2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe	31
PID 2532 wrote to memory of 1924	2532	98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe	31

C:\Users\Admin\AppData\Local\Temp\98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe
"C:\Users\Admin\AppData\Local\Temp\98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe
  C:\Users\Admin\AppData\Local\Temp\98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\98a047a7af1a5b28a27c991aeab7f92ef457071756b73277b443395b4db7662eN.exe

Filesize
92KB

MD5
969211da967619e1df738529fe4b5920

SHA1
b7054831f6588d9dde0667156a8403f6481cc983

SHA256
f36777d911cfaac7c0447cd072c8d3982978795a00157dd3ddc7c4bb1ba8d478

SHA512
47fad931d58031a1e903f5a9e59cbaa416498d6e707a9f41719b21d97f8ccbf101c363d90767818dd5bcfa89628fc7a9b24d7a96894a96882df77e531c492d4f

Download Submit
memory/1924-29-0x0000000000330000-0x000000000034B000-memory.dmp

Filesize
108KB

Download
memory/1924-28-0x00000000002E0000-0x0000000000311000-memory.dmp

Filesize
196KB

Download
memory/1924-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1924-17-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1924-30-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2532-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2532-9-0x0000000000140000-0x0000000000171000-memory.dmp

Filesize
196KB

Download
memory/2532-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download