afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe
Size

6.6MB
MD5

5a331d6fca0a55ac3437468937d07860
SHA1

b87107e084577e90e5321126ca89fef30ff8da2b
SHA256

afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522
SHA512

ed57827723ba18f50ff3810f9d9bdf9ae7635c1e544ef2f6d6fc2337387af718ceb58043eabb50753784fde483ba4207f62e0dfc2e82707f122cf588f7a9532c
SSDEEP

98304:emhd1UryenoQ8UKqXksc8CczYV7wQqZUha5jtSyZIUb+:elHadCCn2QbaZtlit

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2252	687E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2252	687E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	687E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2252	1940	afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe	83
PID 1940 wrote to memory of 2252	1940	afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe	83
PID 1940 wrote to memory of 2252	1940	afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe	83

C:\Users\Admin\AppData\Local\Temp\afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe
"C:\Users\Admin\AppData\Local\Temp\afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\687E.tmp
  "C:\Users\Admin\AppData\Local\Temp\687E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\afb8e6d3761c08b933b7c516abeb53f46401c714f86847b103c486bd180f4522N.exe E8AE84C073A031374FEF9914BC6EF178C65793E3E56A839F639643437071083150C0B846F80E134F12C3C8A5C9DFC4E30548110CB5D2F333E466B30D611663E5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\687E.tmp

Filesize
6.6MB

MD5
0b1ccce74820f6ae51791c643c397ba9

SHA1
33a18eeede85a24ad34bb88789f89e5a18afb999

SHA256
a5fa2a3cc78f27b572dae3eea859b1c0f1a29a05155c6cf0309239f85094089a

SHA512
f27fd9bcca414ec779aa0b07273bc148fde81408824d3684e802321af86d757a43a44adaad44a2bc0c8e05ac96c5dfe029c50ac8967df29b485d1558139a18af

Download Submit
memory/1940-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2252-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download