5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
Size

340KB
MD5

e8703bbb8919c4168b25fe6924578ad1
SHA1

467ea20757ec174fb41a6c1a01ddbdfb68aaee1e
SHA256

5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11
SHA512

a7610c470a2aa7a54d272b4b39fe4cc505de7325dfc92d55046273358537a0545b0762c022f9c4bc3a93eaa69a9098b0f9e8bd9a0dbccbf725357739125417a2
SSDEEP

6144:Kvg8iFtyBSmnt9NuhmJt9IPdO6W+SqR5tulhjH2rBEgh0B:NF/K6+tB6g7LC3h

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4724	my3z9mjusdyxc4mj7u.exe
3488	pudelodyuyz.exe
2332	yrcswtncisj.exe
4472	pudelodyuyz.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\zmqgpbluksgbdhe\xjsejjls	pudelodyuyz.exe
File created	C:\Windows\zmqgpbluksgbdhe\xjsejjls	5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
File created	C:\Windows\zmqgpbluksgbdhe\xjsejjls	my3z9mjusdyxc4mj7u.exe
File created	C:\Windows\zmqgpbluksgbdhe\xjsejjls	pudelodyuyz.exe
File created	C:\Windows\zmqgpbluksgbdhe\xjsejjls	yrcswtncisj.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	my3z9mjusdyxc4mj7u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pudelodyuyz.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	pudelodyuyz.exe
3488	pudelodyuyz.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe
2332	yrcswtncisj.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4724	2128	5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe	83
PID 2128 wrote to memory of 4724	2128	5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe	83
PID 2128 wrote to memory of 4724	2128	5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe	83
PID 3488 wrote to memory of 2332	3488	pudelodyuyz.exe	88
PID 3488 wrote to memory of 2332	3488	pudelodyuyz.exe	88
PID 3488 wrote to memory of 2332	3488	pudelodyuyz.exe	88
PID 4724 wrote to memory of 4472	4724	my3z9mjusdyxc4mj7u.exe	89
PID 4724 wrote to memory of 4472	4724	my3z9mjusdyxc4mj7u.exe	89
PID 4724 wrote to memory of 4472	4724	my3z9mjusdyxc4mj7u.exe	89

C:\Users\Admin\AppData\Local\Temp\5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe
"C:\Users\Admin\AppData\Local\Temp\5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\zmqgpbluksgbdhe\my3z9mjusdyxc4mj7u.exe
  "C:\zmqgpbluksgbdhe\my3z9mjusdyxc4mj7u.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\zmqgpbluksgbdhe\pudelodyuyz.exe
    "C:\zmqgpbluksgbdhe\pudelodyuyz.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4472

C:\zmqgpbluksgbdhe\pudelodyuyz.exe
C:\zmqgpbluksgbdhe\pudelodyuyz.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488
- C:\zmqgpbluksgbdhe\yrcswtncisj.exe
  g2q4kj2f8xcf "c:\zmqgpbluksgbdhe\pudelodyuyz.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\zmqgpbluksgbdhe\my3z9mjusdyxc4mj7u.exe

Filesize
340KB

MD5
e8703bbb8919c4168b25fe6924578ad1

SHA1
467ea20757ec174fb41a6c1a01ddbdfb68aaee1e

SHA256
5ae42a76b8e0be0c51e72253642d2246c40917d0876f644455e5c8086908ae11

SHA512
a7610c470a2aa7a54d272b4b39fe4cc505de7325dfc92d55046273358537a0545b0762c022f9c4bc3a93eaa69a9098b0f9e8bd9a0dbccbf725357739125417a2

Download Submit
C:\zmqgpbluksgbdhe\xjsejjls

Filesize
12B

MD5
7add7a4a5adeea0fd4f36bed5204f30f

SHA1
0c21a63c208893aa5658255eac3284ee4d86673b

SHA256
16f143e4710e25f81d1b2aa245b044e0a5c3970e81e71ec64ef08269bca91010

SHA512
6eef8e9329d9904c7326f2c9c13c9652e327bc4d35d816c10c3a861c3e1be1edbbd31468a5a0a00f8b9b552b78b71275234b85b9437f12fcfaf76c2345580a1d

Download Submit