2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe
Size

297KB
MD5

286c4836067b59eca449097f39af2bb0
SHA1

1a781d7352f45d0b21a2ac9e4b3484eebedef175
SHA256

2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66
SHA512

979f82cc89a7ce7e9742c4e436140f76099bc477d646c73042bafe60c9a45b274ef4b33fcbe6f1bcff1706b8af2b3acf3efbf409347985e317f7f471e00bfb3f
SSDEEP

6144:fgsX5w78W1xrLitFHIp1TP6IUIJxgSQZf3AEfk3COjB8tgnFKzEsTh5/V1K:fgU5w7dxv6FH6l6IUFvA0iCOV8tWM7TC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe

C:\Users\Admin\AppData\Local\Temp\2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe
"C:\Users\Admin\AppData\Local\Temp\2c44c87f82b1737c90577911797ed60029992b13f1ca78e418447c8f5638bc66N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu9ADC0011.dll

Filesize
267KB

MD5
138810868216da6c31f1c3faa4e3ff4c

SHA1
076f99ef5a4a6c3f32b9ab282de0b66b49afd860

SHA256
23f073d05ef6165f38dd5b438d04131f4b95544f1c19ce8230f3ddd1dfe58dce

SHA512
e7eea1a8bd66a4e1e91229d31afde034af7be881603e608171ca37e5802eb726be31c23d46af5538f408c01db7687768e04ec056512fd8afb2d979676ad25c3c

Download Submit
\Users\Admin\AppData\Local\Temp\{F574C9AD-3A69-535A-B1B1-724B2E97EB5B}\_Setup.dll

Filesize
206KB

MD5
a86aa410fb6cec9f140fb7fd12882be9

SHA1
c79c4159ad05ee31aeef9b6bbd505d96f41e1fac

SHA256
a3903f89d8eef0cc9c365a2db4fca0ca1f0654390f182b44e7769454c1aab974

SHA512
70d689077d29ba8138968551b87be405db42c05b547ef36217bc64b548bb41a281086cf02828b9cbd8925e2fda598606c41129b8fd3c7f2e0b630b4188ea800e

Download Submit
\Users\Admin\AppData\Local\Temp\{F574C9AD-3A69-535A-B1B1-724B2E97EB5B}\_Setupx.dll

Filesize
42KB

MD5
66e0d3cb3825b658880be576875795bc

SHA1
740982ce3b3e4bd08c1cbd5fc8cfeb982f1d4e05

SHA256
27b7921fbbd360bf77db65a50b2cd9a600e6baaaf77fd60eee74476d9fc6c7e0

SHA512
23873b2052f66d3b5961cfd5ca26d4d3f507cbd0317116e6b773d23defe47c164e1040fb56392f17cd2644528c64dfbfdeccc46e1965a650786414c8f8f74c7b

Download Submit