b9480120be98f7369d372a385fcdff0769143af90513c26a461e7aeafa8fd9e8

Analysis

max time kernel
149s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/Inst_1105.exe
Size

1.6MB
MD5

3a5b8f1c48b0ee81302dc62de1eee9c2
SHA1

6cec4b89f91d7e3e4ffcab40124f7cf77707dfbd
SHA256

2982a0cc4c6c04a47a70ae73a7e319d9b4c3833448195be33cc967845f410a2e
SHA512

405a6676e3fc1a41f2b53d356263acbfea457df55ec4c34cc6b42bfad6e218491dc5ec31dc77430fc2afcea2288a2d4fd9378fc7777a31149fa459aff6b8e2c0
SSDEEP

49152:pVIfNGpB2kDrgtw+zsEmuxNxO8UB/mC8tljg3JGO8/0:pVyGpB2kMCEmuxHO8UNF8ttg3IH0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4196	INSB8F0.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inst_1105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INSB8F0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4196	1684	Inst_1105.exe	84
PID 1684 wrote to memory of 4196	1684	Inst_1105.exe	84
PID 1684 wrote to memory of 4196	1684	Inst_1105.exe	84

C:\Users\Admin\AppData\Local\Temp\$TEMP\Inst_1105.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\Inst_1105.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\INSB8F0.tmp
  C:\Users\Admin\AppData\Local\Temp\INSB8F0.tmp /SL3 $E0054 C:\Users\Admin\AppData\Local\Temp\$TEMP\Inst_1105.exe 1653354 1656798 66048
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INSB8F0.tmp

Filesize
522KB

MD5
9893a0d7224fa1fd5f39614c18120265

SHA1
c63eafa4b4155f4ce089e515197bae692ee74dc5

SHA256
5fea72be939af54721857ba760b6a12825da0d8327e41c4ee2faa223f48c6c0e

SHA512
fe63e80f0510036b3ddbdd9cccb8ce387b6371a6e1c3199a05930d95536ee00ec7106a12e2a7ac7aedb704d44e081bf1f190288c8d08a4f990ccf3ec8d20c428

Download Submit
memory/1684-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4196-18-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-20-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-9-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-4-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/4196-10-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/4196-22-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-24-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-26-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-28-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-30-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-32-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-34-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4196-36-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download