3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe
Size

368KB
MD5

f258b2b6ffa6756d5f445b1b62685142
SHA1

0c8de6923e6481bd63052539f296dc3b16038a85
SHA256

3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410
SHA512

2a3822658e7a40b5f311066a7d687896eaa4cbea5b5469482bd86201b803bb6008af1a8b09fc50cd178e18b0a6e793540d3afdd0c9ef35e0f4ca2509db254a78
SSDEEP

6144:Ex2oxysMCtUkokSjQhmocTA5QeT4j2tm9o3pXlBVB4wmhA5MKsEB62z:ExPoB0z5Qm4+XlBVB4wmhA5MKsEB62

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe

pid	Process
1532	3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe

C:\Users\Admin\AppData\Local\Temp\3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe
"C:\Users\Admin\AppData\Local\Temp\3a418c405775b28492716a0522b4a327b31ed31697109031c4bc3b1222fe1410.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
440KB

MD5
2144bb21dc2b6e249c1675491b460b3a

SHA1
44c677eac532eff35258c5891303592168aba822

SHA256
a34b2bc8a33eca8bfbb35e62558f2d1cda6cef50dc3e0894b62339d53225d495

SHA512
7b8fcc13bfa2ad80954b97b930c61f866ce31b6b90bc0032acb65d42d4124e2bec98791763e6d532fdb281728a8de49d65ddb74b3983a3328848b00b0225c605

Download Submit
memory/1532-0-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/1532-1-0x0000000000F50000-0x0000000000FB4000-memory.dmp

Filesize
400KB

Download
memory/1532-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1532-7-0x0000000077290000-0x0000000077351000-memory.dmp

Filesize
772KB

Download
memory/1532-8-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download