cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eed

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe
Size

30KB
MD5

c318d5e5d6058d39cb7e8057e94a3630
SHA1

33e41332460d5b1b32e95706cd3752ae4bb6d6ee
SHA256

cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eed
SHA512

c2759fa6e8e70e579940f9bd6f72eaa23cc47d5c177ddb4f5dee5b63b434e43999e87c672571e8b4008ee450d2ef222193fcb535b0c36c7870ebaa5561a02a41
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGo+sj:v/qSamrxDmqoKM4Z0iwtwfR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	2024100907.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024100907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe
4356	2024100907.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4356	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	84
PID 3964 wrote to memory of 4356	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	84
PID 3964 wrote to memory of 4356	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	84
PID 3964 wrote to memory of 3904	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	86
PID 3964 wrote to memory of 3904	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	86
PID 3964 wrote to memory of 3904	3964	cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe	86

C:\Users\Admin\AppData\Local\Temp\cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe
"C:\Users\Admin\AppData\Local\Temp\cd89826cc792e1fa0ed76663d579745bf36c33add22e7b2c38dad6e39aee8eedN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\2024100907.exe
  C:\Users\Admin\AppData\Local\Temp\2024100907.exe down
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024100907.exe

Filesize
30KB

MD5
0cf6f17d1e90df26bad008b78c52d70a

SHA1
2f921746580c4522b108b0fdfb6f68d9d99a3d29

SHA256
0e41e1d5d81595321f2505b754a5c7b273e22eda1c83c7f57cc59da8eb5e29c9

SHA512
bffbac5620b896169ecc7de6fafff906f7a9cc83b6654dba96d9a7110fc350c55052f3955e5ad6766c7b1117b16e40a268de7379b77b67d3c8382c2201add446

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
270B

MD5
bbcad8a318fe8155650830a1754de9f5

SHA1
8511f246bd4e277aa200e9e8597e3fe6453c1cd8

SHA256
976e08db33dd97955bc0f24c401864e720483b39e0fd7af13fded2db180eadf4

SHA512
c7128efa6cb5d983c8698cf79c547f23d4d4502b45d2093a3587300f48f357e7555bb24864bc6b8f123fa055618187ee48631dfd51da067a537295df7bd68bea

Download Submit
memory/4356-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download