Analysis

  • max time kernel
    119s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 08:39

General

  • Target

    49f94189288ffa409388e0e62ccb057da9fa051254d2e2765810908ba8b03688N.exe

  • Size

    68KB

  • MD5

    34144c5c9cfbcc9b67cf29d4dde034c0

  • SHA1

    a2fefe70ce00a3ff347ece28aeb03c67e78d82c9

  • SHA256

    49f94189288ffa409388e0e62ccb057da9fa051254d2e2765810908ba8b03688

  • SHA512

    7af85e6f9ca3cb178b987fa82e1c98f5d3e35b4d5da6e8c4738912bb3557a0d508df1daccc894b48f866c7a3f4982a6f0ec52c2728ca33d408bfe339a0e43629

  • SSDEEP

    1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbIKv8H8hpQc:NAoglOwvl4ulkP6vghzwYu7vih9GueIq

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49f94189288ffa409388e0e62ccb057da9fa051254d2e2765810908ba8b03688N.exe
    "C:\Users\Admin\AppData\Local\Temp\49f94189288ffa409388e0e62ccb057da9fa051254d2e2765810908ba8b03688N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    bd12ebfa5132c8ded4b8ff6969335f1a

    SHA1

    7073d7601187485cee451c70d0bad500229e1f5e

    SHA256

    f28e4699ed678267193d19312d1cb5bcb14252b11e8ed513a745497684ff2a55

    SHA512

    76d7ce7f75bef5da2e189d3a12c5d0411840e5d896f492fc4b41d0441e0ee9bdbfea51e27a239b1eaa6d471d2d59abe207a9c0a00b1d37119f622ed14927fc15

  • memory/2396-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4724-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4724-5-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB