8e12dc4b5b89beab902febe90f49de6f2f0e18ad7399c23fb917f6a6b6b65195

Analysis

max time kernel
1790s
max time network
1576s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rebuilder.exe
Size

114KB
MD5

03d31114dbdd3dd49e6d374930989114
SHA1

a485474bddbe34504d726787f082d40058d26af6
SHA256

4baec23db026d032791adfb7a36f34b3db43adac328bff1365742bcde4b13007
SHA512

72ee30a8204fcf2b651da4771ee40c20113020cbcabd295abebf0fbaaaa4be64fef77c12663080ee5ab9facf86f26c3265db80be93dbdbca5d95e9d611515ea8
SSDEEP

3072:odJyqnWGeiR/llxsIsYMEpOqFHtWIftBKo:odJB9jvOQ/HKo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rebuilder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 308	4144	rebuilder.exe	74
PID 4144 wrote to memory of 308	4144	rebuilder.exe	74
PID 4144 wrote to memory of 308	4144	rebuilder.exe	74
PID 308 wrote to memory of 200	308	cmd.exe	75
PID 308 wrote to memory of 200	308	cmd.exe	75
PID 308 wrote to memory of 200	308	cmd.exe	75
PID 308 wrote to memory of 32	308	cmd.exe	76
PID 308 wrote to memory of 32	308	cmd.exe	76
PID 308 wrote to memory of 32	308	cmd.exe	76
PID 308 wrote to memory of 2232	308	cmd.exe	77
PID 308 wrote to memory of 2232	308	cmd.exe	77
PID 308 wrote to memory of 2232	308	cmd.exe	77
PID 308 wrote to memory of 3452	308	cmd.exe	78
PID 308 wrote to memory of 3452	308	cmd.exe	78
PID 308 wrote to memory of 3452	308	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\rebuilder.exe
"C:\Users\Admin\AppData\Local\Temp\rebuilder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4144H40K.bat" "C:\Users\Admin\AppData\Local\Temp\rebuilder.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\mode.com
    mode con:lines=32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:32
- - C:\Users\Admin\AppData\Local\Temp\tool\sfk.exe
    tool\sfk list -size temp\javachk.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4144H40K.bat

Filesize
56KB

MD5
44e509d6f9afa7d4efd610fa627d2d54

SHA1
808ad3988b5bdde017f5a1ace2ef4c937ef8b2f1

SHA256
f32f2168301fde3d7a18482a04cb05c9e0ae52e9e02fd3a8aeca45345dabfb92

SHA512
44aa5f00f6c7eacc44ad8ba9589cd88c58e8d3b11bd181d455de029e312ef76e6c59f3037ecc1b1e20b04e076394aeb0de703739c2b2999882770eca2d8a7e8d

Download Submit
memory/4144-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download