1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe
Size

936KB
MD5

159eea7c5c04ec53754525ea9bfe14a0
SHA1

76c4982968491aebafc93f88cf3b74f6742ab792
SHA256

1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d
SHA512

b7638c73355b85612dde750fbbd492f0dda33b6e0ab36a02cbf7d170b610107660caa2d209bd609ed9b3d0f305e3e78aec89e34227b395dab1f2c7b2db9f464f
SSDEEP

24576:jj26tCoCDMSkLDU0yHoD9KXbRRIVGgWhBnalIAKc5B88oyY5V:jK6tC9D2LoPHdXs7GnaWAKL5V

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2936	launch.exe

Loads dropped DLL 4 IoCs

pid	Process
2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe
2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe
2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe
2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28
PID 2136 wrote to memory of 2936	2136	1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe	28

C:\Users\Admin\AppData\Local\Temp\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe
"C:\Users\Admin\AppData\Local\Temp\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\DM\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe\1K05V2kveG\launch.exe
  C:\Users\Admin\AppData\Local\Temp\DM\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe\1K05V2kveG\launch.exe "e1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe" "1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe" "cd972224c77341919268506d97bb94de" dec
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DM\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe\1K05V2kveG\launch.exe.config

Filesize
340B

MD5
91629f6b28cbe2b52bb86cb5af3bdbca

SHA1
35fb57ac58c9eb0668f5832a588d9f81e040568b

SHA256
589c122996fadc118731c6f983c5d3b498c4b4b59700ea548f4cfb79e4eaaeeb

SHA512
f08382296696173784841a163c73c19e7bd674a08a053c0434d55696f45039721925e5d829e4bbbf71b07385d1b88c5ea241b8247eb0d81bf381205977bd14c5

Download Submit
\Users\Admin\AppData\Local\Temp\DM\1409817f25c45040cecda9b0b92a9a80dcbd94471bc9146a20086f03ace6869d.exe\1K05V2kveG\launch.exe

Filesize
116KB

MD5
a1f0e62cfb5c26060e379bffd7d8e64e

SHA1
aa5e4b64ca64179ec52a626b305978a0267fa890

SHA256
aeec0c7c423303f58d35f6195b5a2b73bab0c1b5a543e501aa195176ce8ea206

SHA512
0ed899da1c5ccdf6d4a8244d68aeb9e5240bf40aa17545a90eb20408beb195c4876535f0e915188c48f82a4eab29dd7dc897b888b63bec6b791317fccdea3649

Download Submit
\Users\Admin\AppData\Local\Temp\nstA047.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nstA047.tmp\pwgen.dll

Filesize
16KB

MD5
a555472395178ac8c733d90928e05017

SHA1
f44b192d66473f01a6540aaec4b6c9ac4c611d35

SHA256
82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

SHA512
e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

Download Submit
memory/2136-14-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2936-27-0x0000000074211000-0x0000000074212000-memory.dmp

Filesize
4KB

Download
memory/2936-28-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-29-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-30-0x0000000074210000-0x00000000747BB000-memory.dmp

Filesize
5.7MB

Download