4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
Size

213KB
MD5

c8947f4af2a68454adc7ef69474ed460
SHA1

86c9591a2694b73ba65d968eefe6a7275b82c481
SHA256

4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4
SHA512

bcc4333fcebebb69e5a27e453b52c6dc6d8a2dd6ce55d871bec9ce881edb6c0394f003c2f8ecdc61e824887312daac29d72ff0495c6481688ba1223fe50f17f8
SSDEEP

3072:CeUvrwjjl0vxfx8Xxcjx+lzWUzlDASRWvjJ9TMJ9JQqaO4fpNgPYRKitOvoH0:i0jjl0oc9+lz/zl6jrTM2qG7gS7tDH0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2244	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Executes dropped EXE 1 IoCs

pid	Process
2244	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
536	3412	WerFault.exe	81
4576	2244	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3412	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2244	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2244	3412	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	86
PID 3412 wrote to memory of 2244	3412	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	86
PID 3412 wrote to memory of 2244	3412	4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe	86

C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
"C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 396
  2⤵
  - Program crash
  PID:536
- C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
  C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 368
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3412 -ip 3412
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2244 -ip 2244
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4c4a59761d41b7a168b209e1e5cbaedb92d78cf11cb81c33e397fb7aac5c98e4N.exe

Filesize
213KB

MD5
1a13483acccf1d451bca761d324c26e0

SHA1
3338c9781e841a02d28e9b7207bf79ec559ebd5a

SHA256
1b66a028ae4c5f2d5ebf16650539e4de0b99b7b7dbc1beb3fcb577666f0a7113

SHA512
900a46904282cfe21a986d85a65f5252ddeb54e16af04820c9081e6f7b47b6ae7837ee81ca4055a88111278b91e0a1a1b586f2098d0f255b012c28560c6af6aa

Download Submit
memory/2244-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2244-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2244-13-0x00000000014B0000-0x00000000014F1000-memory.dmp

Filesize
260KB

Download
memory/2244-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3412-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3412-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download