98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da

Analysis

max time kernel
11s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe
Size

227KB
MD5

a9ac04a4a30fcf7f57fa94e6bff411fe
SHA1

4c44ef0ec8e8a8d74497d4548f07ff86d6d8426d
SHA256

98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da
SHA512

ab757b0698a72403fbf95612ed28aff4df090590f6121d20cc321931d196af4d8602994b6fb2bff876406fb69c917b2bb936d82fa56b1ebbb4a1e253a0bfa523
SSDEEP

6144:5nllcE8uegM8zBQC/KGKAQ4lOjoegzGXgrshUN8:5agl2C/KGK4lNegzGXgrshUN8

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe

pid	Process
2592	98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe

C:\Users\Admin\AppData\Local\Temp\98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe
"C:\Users\Admin\AppData\Local\Temp\98f915073ebb14e0302f0e75c58e884c8a1ff16647105dcc6efc8606bbe214da.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
339KB

MD5
3efb97fac70bdbed1e6e649b51360580

SHA1
4281ba90149793bce4c54ef8d38ef45eaf464e75

SHA256
11f508d1063a35ae22abe9d5f671016e2e81d056738a13af822fe36b3b4d9756

SHA512
751e9c55429fdfb0e8bc18415d323a2d5e074bf7c2b5355701427077a8e98629bea5106db890378749c388715b718eb76b1505dc57ebcb7f6b8c3addf79c39d9

Download Submit
memory/2592-0-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2592-1-0x0000000000F10000-0x0000000000F52000-memory.dmp

Filesize
264KB

Download
memory/2592-2-0x0000000000830000-0x0000000000836000-memory.dmp

Filesize
24KB

Download
memory/2592-7-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2592-8-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2592-9-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download