176aa707017e73c91de26c96856a10a014f69c881638f4ee2c6cac6b533b2ffa

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
Size

388KB
MD5

a1aa9fc284a78253608b54c1ae6c681f
SHA1

9523103ebd0f1fa5987bb0cfb48c5c89ad4db717
SHA256

176aa707017e73c91de26c96856a10a014f69c881638f4ee2c6cac6b533b2ffa
SHA512

0b46e63c4bdc5a3b552f1de3c90a2e21e8e31bbd6fc98d8c7f3b45cf43d1ce4560b07ff53a68dc3ac6f6af1ad84f6e58943ae55f516a89fb4fe6f4538705422b
SSDEEP

6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oHVCvvy:/uTs1gBpQL5kmh0671o1CS

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1248	conlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conlhost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1248	4212	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	86
PID 4212 wrote to memory of 1248	4212	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	86
PID 4212 wrote to memory of 1248	4212	2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe	86
PID 1248 wrote to memory of 3512	1248	conlhost.exe	87
PID 1248 wrote to memory of 3512	1248	conlhost.exe	87
PID 1248 wrote to memory of 3512	1248	conlhost.exe	87
PID 1248 wrote to memory of 4160	1248	conlhost.exe	92
PID 1248 wrote to memory of 4160	1248	conlhost.exe	92
PID 1248 wrote to memory of 4160	1248	conlhost.exe	92
PID 1248 wrote to memory of 2384	1248	conlhost.exe	95
PID 1248 wrote to memory of 2384	1248	conlhost.exe	95
PID 1248 wrote to memory of 2384	1248	conlhost.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_a1aa9fc284a78253608b54c1ae6c681f_7ev3n.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3512
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\FILES_BACK.txt

Filesize
177B

MD5
fc605d0a0029f229d0ed645293ece316

SHA1
9ee4a83cd232b15790107ebbb98b4b515839f219

SHA256
a2a678d59020d212a1ec32810466b9a2bc4d17fcfff8edd6c07c5aa8ef15b25f

SHA512
2e43a1bbb43f9371cfcdcf550a205bb123a2facf17cbdd180591eb7a7c3ee75b5aae0a59654898814e4dee9d7bdf4ff3f6b50a37f0fbd5252865a23655b261e1

Download Submit
C:\Users\Public\conlhost.exe

Filesize
388KB

MD5
0b93b82b0c3b6732314d17d6d864152e

SHA1
1c8b254e5bbabbb794d8f0cafaef1821b07f1eb5

SHA256
2901bc2c27540d4dc9718d25d30e5349823ddbb49c03f6a805c1e397c3727db5

SHA512
7eea5d02d0774712ed694e2700497c7531c9476a3f05b791842c31fa0cc98c9cc7a9fe0bb6a363f36160f75faf2621807daa6a8b389674c23eeb8f4d4df7861e

Download Submit
C:\users\Public\del.bat

Filesize
115B

MD5
d285bb11b0fb4db4627de1708810f62b

SHA1
e2ea7f2a48a9169dbe93e4ee5e238fe6beb3b9fe

SHA256
b1f0346b9eb5b488449d5dec41f5ff004a7a823ac19f97732609ac53be6d82c9

SHA512
6645a58ce061e0f7105c4c540db139f678b41b1397ea42de82f399a87ddd5f4f07423f5b82710fea3850367aa1b0822fd0e0aa6d009b100a4f93187b059d1bbb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads