198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03

Analysis

max time kernel
31s
max time network
61s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe
Size

1.2MB
MD5

a75294d9174cb4c02f3295faf6bf5800
SHA1

a5d2b6b2ef12d62a5f5d83707f65f9ea9e9a0c62
SHA256

198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03
SHA512

b53e16c1b7b4f151c2a28217aee17bb2382b91f003b5393bb488c5770e137482080cd1a4e91fb8d7a1159a552c51d8d63465747b619de3c2aede97e07ceb1737
SSDEEP

24576:c4PfJIxvZHWxljRNJfycfLee+3BPfr7KzyinI5+VN9g1ymXPa/ZSya/JXk377Lvw:c4eHOlFynnBCVH6rgxg23bnBGKXu/B

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
884	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Executes dropped EXE 1 IoCs

pid	Process
884	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
884	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
884	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 884	2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe	32
PID 2756 wrote to memory of 884	2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe	32
PID 2756 wrote to memory of 884	2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe	32
PID 2756 wrote to memory of 884	2756	198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe	32

C:\Users\Admin\AppData\Local\Temp\198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe
"C:\Users\Admin\AppData\Local\Temp\198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe
  C:\Users\Admin\AppData\Local\Temp\198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\198b4232c63808337dc4faf4079ae3aa9416bcd10907ce00d35e0138da742a03N.exe

Filesize
1.2MB

MD5
b3ef7d41d2579388439620ec411d2cfb

SHA1
47b6624561f3e4925973e6cdc20e8a0a1db4f4da

SHA256
05bf539ee5c22480e67de8aa54a02cde4ba197768353b8cfdfb5a2309febf084

SHA512
414728046f3a3599b015ed42e2a1072ada59c506e5e60e292e2be77fa0cc0c1fb99f93f75a14227e00db29f5802965ca429266cdc8094d07819f961ad72d777c

Download Submit
memory/884-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/884-16-0x0000000002E80000-0x0000000002F94000-memory.dmp

Filesize
1.1MB

Download
memory/884-9-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/884-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/884-38-0x000000000EE70000-0x000000000EF13000-memory.dmp

Filesize
652KB

Download
memory/884-39-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2756-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2756-8-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download