3e611f3a60b74b9c9f38fe5d6c1f7d900a1a8ec5fdce26393b5ce41ba037ce31

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1stsol-v24.exe
Size

8.9MB
MD5

7832eaebce980435a8a443819d3d2ba6
SHA1

e7c8e7adc7c63e2b00881bf7ba8e1e3dc934aa06
SHA256

3e611f3a60b74b9c9f38fe5d6c1f7d900a1a8ec5fdce26393b5ce41ba037ce31
SHA512

d624c46d4905307fcea4464983758b03fec81f1426021dbb24cbb94c8e26b2bcf482e02e3e42cd3bf8dd34d2ade8d0da798949e1907fe326fd3863504044bc94
SSDEEP

196608:MRWwi/INB1l6/cl89BBcwYKAGx9Tn+1W41Q2H/O5NSTuwQ2SnxBzv70:M40/D8nvgGxZ34S2HWJwQbxB/0

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	1stsol-v24.tmp

Loads dropped DLL 1 IoCs

pid	Process
2976	1stsol-v24.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1stsol-v24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1stsol-v24.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30
PID 2976 wrote to memory of 1968	2976	1stsol-v24.exe	30

C:\Users\Admin\AppData\Local\Temp\1stsol-v24.exe
"C:\Users\Admin\AppData\Local\Temp\1stsol-v24.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\is-IHCKN.tmp\1stsol-v24.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IHCKN.tmp\1stsol-v24.tmp" /SL5="$40016,8881452,121344,C:\Users\Admin\AppData\Local\Temp\1stsol-v24.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-IHCKN.tmp\1stsol-v24.tmp

Filesize
1.1MB

MD5
9bf6be74782de2e2cd188a2114d4b58c

SHA1
6e9e8feeebcb00c5e1c51901b9b4b42d4cc445f7

SHA256
ad43201afae2942efc817f659fab4146f2a799b7c5d8d2b43bd89dbb7991b2cc

SHA512
34ab63c80fdbbbe22ecdbcbd9ab5d41d8f02fcff3f55bc6725f8cf8fd9e1e92d56141dcbf5fa92685b5aa9a83c175184369106ccf4994ffb897f72aa5f23da9d

Download Submit
memory/1968-26-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-24-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-8-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-38-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-12-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-14-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-16-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-18-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-36-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-20-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-22-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-34-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-28-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-30-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/1968-32-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2976-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2976-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download