Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
-
Size
340KB
-
MD5
e8703bbb8919c4168b25fe6924578ad1
-
SHA1
467ea20757ec174fb41a6c1a01ddbdfb68aaee1e
-
SHA256
5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11
-
SHA512
a7610c470a2aa7a54d272b4b39fe4cc505de7325dfc92d55046273358537a0545b0762c022f9c4bc3a93eaa69a9098b0f9e8bd9a0dbccbf725357739125417a2
-
SSDEEP
6144:Kvg8iFtyBSmnt9NuhmJt9IPdO6W+SqR5tulhjH2rBEgh0B:NF/K6+tB6g7LC3h
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1920 my4agic9sdyxc4mj7u.exe 2500 pudelodyuyz.exe 2068 yrcswtncisj.exe 2728 pudelodyuyz.exe -
Loads dropped DLL 5 IoCs
pid Process 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 2500 pudelodyuyz.exe 2500 pudelodyuyz.exe 1920 my4agic9sdyxc4mj7u.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\zmqgpbluksgbdhe\xjsejjls 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe File created C:\Windows\zmqgpbluksgbdhe\xjsejjls my4agic9sdyxc4mj7u.exe File created C:\Windows\zmqgpbluksgbdhe\xjsejjls pudelodyuyz.exe File created C:\Windows\zmqgpbluksgbdhe\xjsejjls yrcswtncisj.exe File created C:\Windows\zmqgpbluksgbdhe\xjsejjls pudelodyuyz.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pudelodyuyz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language my4agic9sdyxc4mj7u.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 pudelodyuyz.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe 2068 yrcswtncisj.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1920 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 30 PID 2332 wrote to memory of 1920 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 30 PID 2332 wrote to memory of 1920 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 30 PID 2332 wrote to memory of 1920 2332 5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe 30 PID 2500 wrote to memory of 2068 2500 pudelodyuyz.exe 32 PID 2500 wrote to memory of 2068 2500 pudelodyuyz.exe 32 PID 2500 wrote to memory of 2068 2500 pudelodyuyz.exe 32 PID 2500 wrote to memory of 2068 2500 pudelodyuyz.exe 32 PID 1920 wrote to memory of 2728 1920 my4agic9sdyxc4mj7u.exe 33 PID 1920 wrote to memory of 2728 1920 my4agic9sdyxc4mj7u.exe 33 PID 1920 wrote to memory of 2728 1920 my4agic9sdyxc4mj7u.exe 33 PID 1920 wrote to memory of 2728 1920 my4agic9sdyxc4mj7u.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe"C:\Users\Admin\AppData\Local\Temp\5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\zmqgpbluksgbdhe\my4agic9sdyxc4mj7u.exe"C:\zmqgpbluksgbdhe\my4agic9sdyxc4mj7u.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\zmqgpbluksgbdhe\pudelodyuyz.exe"C:\zmqgpbluksgbdhe\pudelodyuyz.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2728
-
-
-
C:\zmqgpbluksgbdhe\pudelodyuyz.exeC:\zmqgpbluksgbdhe\pudelodyuyz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\zmqgpbluksgbdhe\yrcswtncisj.exeg2q4kj2f8xcf "c:\zmqgpbluksgbdhe\pudelodyuyz.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD57add7a4a5adeea0fd4f36bed5204f30f
SHA10c21a63c208893aa5658255eac3284ee4d86673b
SHA25616f143e4710e25f81d1b2aa245b044e0a5c3970e81e71ec64ef08269bca91010
SHA5126eef8e9329d9904c7326f2c9c13c9652e327bc4d35d816c10c3a861c3e1be1edbbd31468a5a0a00f8b9b552b78b71275234b85b9437f12fcfaf76c2345580a1d
-
Filesize
340KB
MD5e8703bbb8919c4168b25fe6924578ad1
SHA1467ea20757ec174fb41a6c1a01ddbdfb68aaee1e
SHA2565ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11
SHA512a7610c470a2aa7a54d272b4b39fe4cc505de7325dfc92d55046273358537a0545b0762c022f9c4bc3a93eaa69a9098b0f9e8bd9a0dbccbf725357739125417a2