26dcefb48f3b7fa97765b0f4db3ebfbf615f57b42c7c051c145e8981c4dbbdb3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dpwwkbvgzxukmji.exe
Size

1.2MB
MD5

bdea975f05590979c4193de0b984da84
SHA1

b37c50bda301d647282ef6cf5bd7d411e295cae9
SHA256

26dcefb48f3b7fa97765b0f4db3ebfbf615f57b42c7c051c145e8981c4dbbdb3
SHA512

59e19339b4681d45a644c7eeae00329e5cd9a56c6ecc17331bc43dcbaa020bf39cad5d241c365bbda0aa0f3ccaf0cd17ad1cccce381014169882a592570e666a
SSDEEP

24576:Gtb20pkaCqT5TBWgNQ7aMN7IcAo6iRzpaOF/mN16AK:zVg5tQ7aMN7IryzpaOpmr5K

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dpwwkbvgzxukmji.fr.url	dpwwkbvgzxukmji.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	1200	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpwwkbvgzxukmji.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1200	dpwwkbvgzxukmji.exe
1200	dpwwkbvgzxukmji.exe
1200	dpwwkbvgzxukmji.exe
1200	dpwwkbvgzxukmji.exe
1200	dpwwkbvgzxukmji.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 3060	1200	dpwwkbvgzxukmji.exe	30
PID 1200 wrote to memory of 1892	1200	dpwwkbvgzxukmji.exe	31
PID 1200 wrote to memory of 1892	1200	dpwwkbvgzxukmji.exe	31
PID 1200 wrote to memory of 1892	1200	dpwwkbvgzxukmji.exe	31
PID 1200 wrote to memory of 1892	1200	dpwwkbvgzxukmji.exe	31

C:\Users\Admin\AppData\Local\Temp\dpwwkbvgzxukmji.exe
"C:\Users\Admin\AppData\Local\Temp\dpwwkbvgzxukmji.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 312
  2⤵
  - Program crash
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dgfdtbpo

Filesize
322KB

MD5
229969ae0032bf818c604a1370a1cf14

SHA1
14772f98b1c8d7631ef57f1dfc3abf517b77d49f

SHA256
468c9575e6be0ea0ef82b29f087c7901bfe49731a1f88e2f7cda26242dfbaeed

SHA512
f1a6140d1ea077acc67b9193c7cfe06f4c5741c2320bc3a002553a7ee3f845342bda899448f2cb3f4ada11934277911280a188aebe046053f0cdf8097b4eaf30

Download Submit
memory/1200-10-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1200-9-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1200-11-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1200-13-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1200-12-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download