4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4

Analysis

max time kernel
80s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
Size

213KB
MD5

c8947f4af2a68454adc7ef69474ed460
SHA1

86c9591a2694b73ba65d968eefe6a7275b82c481
SHA256

4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4
SHA512

bcc4333fcebebb69e5a27e453b52c6dc6d8a2dd6ce55d871bec9ce881edb6c0394f003c2f8ecdc61e824887312daac29d72ff0495c6481688ba1223fe50f17f8
SSDEEP

3072:CeUvrwjjl0vxfx8Xxcjx+lzWUzlDASRWvjJ9TMJ9JQqaO4fpNgPYRKitOvoH0:i0jjl0oc9+lz/zl6jrTM2qG7gS7tDH0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2128	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Executes dropped EXE 1 IoCs

pid	Process
2128	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Loads dropped DLL 1 IoCs

pid	Process
2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2128	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2128	2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	31
PID 2916 wrote to memory of 2128	2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	31
PID 2916 wrote to memory of 2128	2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	31
PID 2916 wrote to memory of 2128	2916	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	31

C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
"C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
  C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Filesize
213KB

MD5
c1fd3f1c8c5d9c5743848816abc21b7f

SHA1
f960c7b98e4ac306492f8a0b521c1edf8aabf177

SHA256
99dda1b6ad36174afbc3e9ca5dcea9f883f197a92b92c280df2df8dd633e1156

SHA512
96fa5099f571ceba97285a714a409fabb3158db44cfb4c30477c0335e68f7709d72f7df2e490bd91efae305ddf2a019227a26140771a3422c10748152d168c89

Download Submit
memory/2128-17-0x0000000000130000-0x0000000000171000-memory.dmp

Filesize
260KB

Download
memory/2128-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2128-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2128-18-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-6-0x00000000003B0000-0x00000000003F1000-memory.dmp

Filesize
260KB

Download