908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b

General

Target

908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe
Size

4.3MB
MD5

f28108da6ac6b2d0e642d235a58d5135
SHA1

7a67c8b3c2b984123ee94d63e04b9834a1f74df0
SHA256

908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b
SHA512

1024cba581c741f3762e78babaee6cbe1903a5c898101c2b91b24d1b58764e3e41df086243a2af4489a855ddeb8e039e88d54cc62da5764605d983fc0fd1253c
SSDEEP

98304:6jqXAXronOPHXt8lonAUCR1jZc7jF20LJUYPsOJZof4ZvQup:6jqQXr9yPXq7k0lUYPsOJZNZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp

Loads dropped DLL 4 IoCs

pid	Process
1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe
1672	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp
1672	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp
1672	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30
PID 1076 wrote to memory of 1672	1076	908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe	30

C:\Users\Admin\AppData\Local\Temp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe
"C:\Users\Admin\AppData\Local\Temp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\is-EI2ND.tmp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EI2ND.tmp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp" /SL5="$5014E,3885013,275456,C:\Users\Admin\AppData\Local\Temp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-EI2ND.tmp\908ac546a0287c805f42e5a70a2cc51f75839498797f4b44a989f73c4dc2797b.tmp

Filesize
1.6MB

MD5
1353722dc9206c5b37d7ffebdf530d8f

SHA1
50e7e6b77659d291d3a8ae61e2babd8b381f9afe

SHA256
0974eebd3a1cab76d5fe77b493070a68e6fe5e1584b80c5a811ac18696796646

SHA512
36b3c23405ccd1785b7aa2ee149bfccc02a70814262fb95f9e0d726b88184fb9616616cb23c2aa3ff1f97f588d15588e985e456a3f19104930ce70de5f114993

Download Submit
\Users\Admin\AppData\Local\Temp\is-H2PTM.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-H2PTM.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/1076-19-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1076-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/1076-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1672-27-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-33-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-23-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-25-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-10-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-29-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-31-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-21-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-35-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-37-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-39-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-41-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-43-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-45-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1672-47-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing