4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5f

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe
Size

932KB
MD5

c3170ea60f9e02e961e4abb34e211ff0
SHA1

9c89231011e98bde4725d8f6b5a7f36fe78452b1
SHA256

4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5f
SHA512

51ce169ca830d2184c2b51667ea668ce7d6b2c041f68090931f87eaf77adc47c691174d8ca13f4d057693ff77919ff669acae8a11543b0be7e037f776aede997
SSDEEP

24576:TabDmFJTqJG882C0CST8oV+rLZmN17UZmlSJrE:TabDWZqk1kT8xPZmXgZmlSJrE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4296	77DF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77DF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4296	2964	4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe	83
PID 2964 wrote to memory of 4296	2964	4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe	83
PID 2964 wrote to memory of 4296	2964	4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe	83

C:\Users\Admin\AppData\Local\Temp\4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe
"C:\Users\Admin\AppData\Local\Temp\4e9b0e3c283411cdf0e77e5c70e63a83a5e82c56eb58c0f005ac1144a41a2b5fN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\77DF.tmp
  "C:\Users\Admin\AppData\Local\Temp\77DF.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\77DF.tmp

Filesize
932KB

MD5
8f5d567998c8971b060f69ad785374fc

SHA1
25c1d8055cdbbc0a7a107b7a2a08f6668de4a639

SHA256
876cd1591e3d78ffcc28d655948c2084e350440ba18b48d0e94a716cefd6e263

SHA512
982df21dc7ce35414f85d6e1f716c1a354a6946e2dc1147f6c0d9fc303eed6d9020bb9d50e588cbb154e459add3ce79ad9d79ff164a8190c81159fd384b72288

Download Submit