90b3492bccc79a9f81caf0d7832d63dce4d5b8905d2e6aef90f6ca57c9662671

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sapphire.ofx.6.10-patch64.exe
Size

994KB
MD5

db37165c758b304d69e3d09973fdfe71
SHA1

691e28795cd320d3176b579967356ad83a17d7dc
SHA256

90b3492bccc79a9f81caf0d7832d63dce4d5b8905d2e6aef90f6ca57c9662671
SHA512

8dc5bb6c5bf376dfbdccb95b9a6efa18d156c610237d029d55a46e2897fa51b6212651c988070f85078b4b98cef9079fa02207bcf6acecf679046739ffc1217b
SSDEEP

24576:mU92cIO2Gq+59y/odfRO+KUOdC5X46hXyVDkryBIh5K4IHRP:mC2cL2/AdfRO+cezy21h5kR

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1168	sapphire.ofx.6.10-patch64.exe
1168	sapphire.ofx.6.10-patch64.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sapphire.ofx.6.10-patch64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4848	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\sapphire.ofx.6.10-patch64.exe
"C:\Users\Admin\AppData\Local\Temp\sapphire.ofx.6.10-patch64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
1.0MB

MD5
e3391886d979d9c2686a9a6fb2b1aa17

SHA1
76fd66cb39d239fc711d02494e0fc1cda38e551e

SHA256
16c2393534f197ba52640b3690b7dc2eb11600297a0dc2f2cb38d690109974a0

SHA512
804ae4ded15f8732d9a7bef5bb1d0b9a18708bdcdf82a8ab4a7a2dfd29458846e78f5e74a22d19ac1394402c8dc7818c054b7acf84b599bb08e11ce7c305ba2e

Download Submit
memory/1168-0-0x00000000009F0000-0x0000000000B06000-memory.dmp

Filesize
1.1MB

Download
memory/1168-1-0x00000000012F0000-0x00000000012F3000-memory.dmp

Filesize
12KB

Download
memory/1168-4-0x0000000075460000-0x000000007557D000-memory.dmp

Filesize
1.1MB

Download
memory/1168-12-0x00000000009F0000-0x0000000000B06000-memory.dmp

Filesize
1.1MB

Download