6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
Size

5.7MB
MD5

bca5f0335502dfdfda3f9beecf1a2174
SHA1

3affd6d047e51c45d3781b0b4f1bd9e73e829393
SHA256

6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e
SHA512

ac5395dafe444cfa32838ed4a910c2237ca7b859efdb35f4f2f47319e780e1f019fdb190598652e91871ca9de97a104f11ed0318ddcdeb83a4cf017d6abf2ee7
SSDEEP

98304:TY8dy1Q/IgyJxB6IREAyhCTJK2pHpceg2EQgY/iwYHdQxTdTgxBDTR39x9qUW+m:UQyyAgyc2w2p2sgxdDuU

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
2460	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2460	1140	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe	86
PID 1140 wrote to memory of 2460	1140	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe	86
PID 1140 wrote to memory of 2460	1140	6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe	86

C:\Users\Admin\AppData\Local\Temp\6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
"C:\Users\Admin\AppData\Local\Temp\6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe
  "C:\Users\Admin\AppData\Local\Temp\6cc904fdb711147ac2b52e50afa7cf58551967948ab0d23702597fef319e897e.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI11402\VCRUNTIME140.dll

Filesize
74KB

MD5
5f9d90d666620944943b0d6d1cca1945

SHA1
08ead2b72a4701349430d18d4a06d9343f777fa6

SHA256
9ec4afad505e0a3dad760fa5b59c66606ae54dd043c16914cf56d7006e46d375

SHA512
be7a2c9dae85e425a280af552dbd7efd84373f780fa8472bab9a5ff29376c3a82d9dfa1fef32c6cf7f45ba6e389de90e090cb579eebff12dcfe12e6f3e7764d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\_bz2.pyd

Filesize
77KB

MD5
18cd8755e6d4559840d07467df26af34

SHA1
a88ac5c278242308e44a96c01d45663b0b930395

SHA256
82a85187faf8786216c82ac1c4ccf32c8839048e242025ed4e7a1e3ab870255f

SHA512
8d5b4afdc836145443ce2502b52ef350d7f6017aba609d40ec1aafd2cbccb515debc0b04aa6001c690e537f33ca45151134586c32845924aa5afccccc35a82ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\_decimal.pyd

Filesize
223KB

MD5
1ff7408362c06ce1c23d8e371ce18a16

SHA1
e012a785d9e3abfac5a04f4bca2241b00c2c54a7

SHA256
44107df49d7dbea4e5d1c7f8a24b2d30c7f4d1623f599c4ea9f5f36c05fe0ee6

SHA512
ffb264658e766716652f0661354badab8862c8d6e80f3fa5d7ef987b5a82da98b16532dfb8695310764b16071a022abe83ec8314968c5db4e715b95e553cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\_lzma.pyd

Filesize
155KB

MD5
b23d17b4b3b15dab84e384b8dd1d8fc6

SHA1
72fcf3b4cd61b0a8cb282760c9fd466dbb12565b

SHA256
d3350ad957d6c37b2c75f56a5a149f0eeb58295227f78c15048669a2e816ae3a

SHA512
e14a1a3b59da76204325c3edd890ca865262b7fab12fb0fa9754f7a425a64b094b8da75236f0a665d1624229bbeced8b661c452af5798006609a5a4f7f08abb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\base_library.zip

Filesize
1008KB

MD5
7cda1e5bb461a4919644cdca7b73d4ee

SHA1
98958098c6caa94a763b0d0770feffe6a9714629

SHA256
cbeefa7822962ccbee44fde6f55ff2e64ff56b3d9d19c1f9031c68fbeae5b3d8

SHA512
7b01a377b21ce3c257a7a5fb36d35715ad94f1d7207743130099e8a67c9fd49d3c8f7b0bbf47f83c288f0933ffa728877606931dc31b88dd027a9cb3303a6f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\python38.dll

Filesize
3.9MB

MD5
9f8e0de6e7d4b165b4a49600daacc3b1

SHA1
8cf37d69fdaf65c49f7f5e048c0085b207f7287b

SHA256
a9675a91d767095c9d4a2ae1df6e17bdb59102dbd2b4504c3493b0bcbed5ef55

SHA512
3201b7adf94d3f4510e0b39b4766d1314da66662819fd6de5f5f71956750bb4fdf4228b6e1ad9d4d3bc1fdeb99b7414ed2eff0374aaa3216b67eeedfb8673b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11402\ucrtbase.dll

Filesize
880KB

MD5
5b55e9a1360a6c52cc988da6804d6ca2

SHA1
ab36f680029c672b885d52ae376b80b4752f5f80

SHA256
ab2bbec93fa2af707d9c55b3db442dde6561d1799e53e74c7f6345252989798c

SHA512
b7b3116bad981464155d1c8b0a0db0793661f73ffa20d1e37e52f3a3785635afe1b803e65d657213adfe2d6a972e84da10050f31522e8acce27b65f2a8bc4261

Download Submit