51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe
Size

2.4MB
MD5

bff06775461065b057ccdbff79fc2819
SHA1

3976ef48c5e71635f7de8147105f55291b7e04c1
SHA256

51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f
SHA512

6e43fbdf8103b72350130f894a72bf3fa2e7def61ed9a2d1d38c6b8745f97e5b45a195da818edb2c453c1305d1e036c41a5da0d617d8f18130a123e77d764359
SSDEEP

49152:2BuZrEUnje0NQq5rISAGFRjM9j6pjIMGFTKakX:AkLjNNC7ee9aEbJcX

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4720	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp

Loads dropped DLL 1 IoCs

pid	Process
4720	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4720	2648	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe	85
PID 2648 wrote to memory of 4720	2648	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe	85
PID 2648 wrote to memory of 4720	2648	51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe	85

C:\Users\Admin\AppData\Local\Temp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe
"C:\Users\Admin\AppData\Local\Temp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\is-HAUD7.tmp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HAUD7.tmp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp" /SL5="$501F6,1573616,832512,C:\Users\Admin\AppData\Local\Temp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-HAUD7.tmp\51f9879646e8b8f3ee49f7f0e250cf2c93b2ab9ee76e3f79778bbfbd3659f86f.tmp

Filesize
3.1MB

MD5
02b1d8ff84bcd4ebcb01156636269b99

SHA1
15ba86430b90264da7d9f2c05be57c56640d4ba9

SHA256
a6497ddddd577caefe5a39958a604f9ee4bfe93e9da285b147ba6fc6788e75ca

SHA512
640227915b78fb8e0fd8e6a6ca883e4ed4e3fa45524fca5a9344c067840b3fc11c7b98fd05351eabaee3d4afa21711dc0999175cbc154d13b02135706ef5b47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RJG0N.tmp\Helper.dll

Filesize
2.0MB

MD5
4eb0347e66fa465f602e52c03e5c0b4b

SHA1
fdfedb72614d10766565b7f12ab87f1fdca3ea81

SHA256
c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc

SHA512
4c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd

Download Submit
memory/2648-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2648-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2648-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2648-20-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4720-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4720-15-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4720-18-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download