7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848f

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
Size

401KB
MD5

a3be669f04806d449d9d02107254ec80
SHA1

6b53cb0d44ee8e1509f1bf868b65860fbedcc5a7
SHA256

7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848f
SHA512

c14eb911f20a33d9224ec3f1d81541542db0d8e5bec087044fa3e98592b83cf463453f7136105d635ee962e87908abf61d77b09cb29b2d1ed433ec563f1e02b3
SSDEEP

12288:zbCt3hr+kdtROhrQEsz1J8/kT9mxFJlJncJQ3Tk:YrXtMQX78MZEFJlGJco

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3004	that.exe

Loads dropped DLL 2 IoCs

pid	Process
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\program files\RealPlay\games\that.exe	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	that.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
3004	that.exe
3004	that.exe
3004	that.exe
3004	that.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3004	1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe	30
PID 1988 wrote to memory of 3004	1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe	30
PID 1988 wrote to memory of 3004	1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe	30
PID 1988 wrote to memory of 3004	1988	7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe	30

C:\Users\Admin\AppData\Local\Temp\7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe
"C:\Users\Admin\AppData\Local\Temp\7c2104e39be66857e8e816979b757f136787f0b768ed9dcd2ee52a7494fc848fN.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- \??\c:\program files\RealPlay\games\that.exe
  "c:\program files\RealPlay\games\that.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\RealPlay\games\that.exe

Filesize
401KB

MD5
0f75c61f243b9937c241528aebcc75b3

SHA1
995592615f464714e62e0258929fb71671504720

SHA256
b0b917459e410d29806ae39c693a1e9f1c66a28e75fd042174b99fc7a4596ec5

SHA512
e7deb50155b7d798ee5c50274cff711806ef2a63721649e4b78076efd9a34f64a4bd501cb2e4b10e3aef8f59a9d67777681c81b107d6a637110617612e98302d

Download Submit