454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe
Size

4.9MB
MD5

f8cb5b3d21bbcaafb3a525bca983bd78
SHA1

0b6c413eafa93b27e1d2ff981af0dfc1dd9750bb
SHA256

454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65
SHA512

e036c28ef173f4fb435ec8883b3713ac5b5f58953148fdf41bec6b504cddbc0074e7303fb1eeec24b0c19eda6e2663cc183a6cd3f954ca7f83847cb7e53badc5
SSDEEP

49152:Q4qOZslHLGk6/keAm0Z3UZaJtp+s8KuqGaX0ToIBAUZLYg:TqOMHLF6/kez0EJBAUZLj

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 4364	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	135

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1332	5080	WerFault.exe	82
2008	4364	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpresult.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe
5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe
4364	gpresult.exe
4364	gpresult.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1688	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	88
PID 5080 wrote to memory of 1688	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	88
PID 5080 wrote to memory of 1688	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	88
PID 5080 wrote to memory of 972	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	89
PID 5080 wrote to memory of 972	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	89
PID 5080 wrote to memory of 972	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	89
PID 5080 wrote to memory of 2412	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	90
PID 5080 wrote to memory of 2412	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	90
PID 5080 wrote to memory of 2412	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	90
PID 5080 wrote to memory of 1044	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	91
PID 5080 wrote to memory of 1044	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	91
PID 5080 wrote to memory of 1044	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	91
PID 5080 wrote to memory of 4392	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	92
PID 5080 wrote to memory of 4392	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	92
PID 5080 wrote to memory of 4392	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	92
PID 5080 wrote to memory of 4808	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	93
PID 5080 wrote to memory of 4808	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	93
PID 5080 wrote to memory of 4808	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	93
PID 5080 wrote to memory of 4436	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	94
PID 5080 wrote to memory of 4436	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	94
PID 5080 wrote to memory of 4436	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	94
PID 5080 wrote to memory of 1528	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	95
PID 5080 wrote to memory of 1528	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	95
PID 5080 wrote to memory of 1528	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	95
PID 5080 wrote to memory of 2884	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	96
PID 5080 wrote to memory of 2884	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	96
PID 5080 wrote to memory of 2884	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	96
PID 5080 wrote to memory of 4168	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	97
PID 5080 wrote to memory of 4168	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	97
PID 5080 wrote to memory of 4168	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	97
PID 5080 wrote to memory of 3076	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	98
PID 5080 wrote to memory of 3076	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	98
PID 5080 wrote to memory of 3076	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	98
PID 5080 wrote to memory of 3384	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	99
PID 5080 wrote to memory of 3384	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	99
PID 5080 wrote to memory of 3384	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	99
PID 5080 wrote to memory of 1612	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	100
PID 5080 wrote to memory of 1612	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	100
PID 5080 wrote to memory of 1612	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	100
PID 5080 wrote to memory of 1416	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	101
PID 5080 wrote to memory of 1416	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	101
PID 5080 wrote to memory of 1416	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	101
PID 5080 wrote to memory of 2356	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	102
PID 5080 wrote to memory of 2356	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	102
PID 5080 wrote to memory of 2356	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	102
PID 5080 wrote to memory of 3180	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	103
PID 5080 wrote to memory of 3180	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	103
PID 5080 wrote to memory of 3180	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	103
PID 5080 wrote to memory of 2272	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	104
PID 5080 wrote to memory of 2272	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	104
PID 5080 wrote to memory of 2272	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	104
PID 5080 wrote to memory of 1844	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	105
PID 5080 wrote to memory of 1844	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	105
PID 5080 wrote to memory of 1844	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	105
PID 5080 wrote to memory of 4056	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	106
PID 5080 wrote to memory of 4056	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	106
PID 5080 wrote to memory of 4056	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	106
PID 5080 wrote to memory of 812	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	107
PID 5080 wrote to memory of 812	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	107
PID 5080 wrote to memory of 812	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	107
PID 5080 wrote to memory of 2768	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	108
PID 5080 wrote to memory of 2768	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	108
PID 5080 wrote to memory of 2768	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	108
PID 5080 wrote to memory of 1976	5080	454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe	109

C:\Users\Admin\AppData\Local\Temp\454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe
"C:\Users\Admin\AppData\Local\Temp\454712f18c5e300c17067c356bb0e6536eaae0359c55def9168639808cb25a65.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1688
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:972
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1044
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4392
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4808
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2884
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3076
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1612
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3180
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2272
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1844
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4056
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:812
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1976
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3956
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4268
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4528
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3952
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:2900
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1404
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 704
  2⤵
  - Program crash
  PID:1332
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1492
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:3592
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:8
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4016
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1664
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4860
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:4796
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\SysWOW64\ftp.exe"
  2⤵
  PID:1576
- C:\Windows\SysWOW64\gpresult.exe
  "C:\Windows\SysWOW64\gpresult.exe"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\gpresult.exe
  "C:\Windows\SysWOW64\gpresult.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 760
    3⤵
    - Program crash
    PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5080 -ip 5080
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4364 -ip 4364
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-1-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4364-2-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4364-5-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4364-4-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4364-9-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/4364-10-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/5080-0-0x0000000000FA0000-0x0000000000FAD000-memory.dmp

Filesize
52KB

Download
memory/5080-3-0x0000000000FA0000-0x0000000000FAD000-memory.dmp

Filesize
52KB

Download