dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808cea

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
Size

208KB
MD5

3a0a6465ba076a8fe7b9c490ad68d4b0
SHA1

7dcb1c7634a0bf47bdfbe5d40a291a704cdafe45
SHA256

dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808cea
SHA512

31f7477e2d1d94ee36d4d65d7f1079f6ec4effe7cdaabe71bba7db132cdc4b681d210577535081dd5912ffc5a524389c7c264989dff979fff3b9d4460dff7d21
SSDEEP

6144:M2okEE6seNrgUgOch5CyOiAR/oiED6D+950HZIQEjE:BokEEleP1umNoiEG+aZIQn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2792	EMIEUX.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\EMIEUX.exe	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
File opened for modification	C:\windows\EMIEUX.exe	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
File created	C:\windows\EMIEUX.exe.bat	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMIEUX.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
2792	EMIEUX.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
2792	EMIEUX.exe
2792	EMIEUX.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1916	2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe	30
PID 2308 wrote to memory of 1916	2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe	30
PID 2308 wrote to memory of 1916	2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe	30
PID 2308 wrote to memory of 1916	2308	dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe	30
PID 1916 wrote to memory of 2792	1916	cmd.exe	32
PID 1916 wrote to memory of 2792	1916	cmd.exe	32
PID 1916 wrote to memory of 2792	1916	cmd.exe	32
PID 1916 wrote to memory of 2792	1916	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe
"C:\Users\Admin\AppData\Local\Temp\dcb8de0cb3c5816d483119a3c51d635b3b8889de72462bb387e96269ca808ceaN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\windows\EMIEUX.exe.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\windows\EMIEUX.exe
    C:\windows\EMIEUX.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\EMIEUX.exe.bat

Filesize
58B

MD5
0c97803380105defc90255fc3cc52416

SHA1
da4d3a3e46238436891391ec5d16da69bf8e5ac0

SHA256
3fd585303a1396b16c336b6800f0e0511796f08b5f2134775c306691585944da

SHA512
492fc333931f44c6ad3052ada1f3cbeb152473a570d85f591e711c070eb1a8e7076c9e466d1d033683d54c4783f3032f63f6a73e249b21076cab1d7293446e64

Download Submit
C:\windows\EMIEUX.exe

Filesize
208KB

MD5
e158bc6b7b20d076038e2ea5340bdd51

SHA1
72082086c02aeeba386c2e7258db77ef6d7b4a43

SHA256
e5a0d6898ad31525902e26eeac94c7b147d4dcf5da26e0ab5b55c3d9fb6f7cff

SHA512
a21ae67161de1befdda19ae517be75ddfde27d562b4fc392f0a894e080be6e294a903f71a395d51a129082d0efe341688cced583342973d2885e4d5ec06eac2d

Download Submit
memory/1916-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2308-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2792-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download