5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318

Analysis

max time kernel
120s
max time network
113s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe
Size

68KB
MD5

456c408cd1d72f9ca7974483cdfc2f40
SHA1

b753d4c32e82f51122f874ce50406ba272a7b7cb
SHA256

5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318
SHA512

5ec617169281947db05cf28556f984a723448ba3788712f455b9da455ea543783267dcf8b7197f75aabb953394aa0065cde3c240dd0ef66717dfd043c8ba1c21
SSDEEP

1536:t0GIXAic1p4Ox5/P6471d+oNQvX7XLUNmAVqxh22zkZ5ZZ:iX9071d+97XLUNmKqVz0Z

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2156	izilysa.exe

Loads dropped DLL 1 IoCs

pid	Process
2444	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izilysa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2156	2444	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe	30
PID 2444 wrote to memory of 2156	2444	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe	30
PID 2444 wrote to memory of 2156	2444	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe	30
PID 2444 wrote to memory of 2156	2444	5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe	30

C:\Users\Admin\AppData\Local\Temp\5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe
"C:\Users\Admin\AppData\Local\Temp\5f9ef50c64a2a702e38b3a684cf2e5e1f24dca2d71b56d097262913ed6466318N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\izilysa.exe
  C:\Users\Admin\AppData\Local\Temp\izilysa.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\izilysa.exe

Filesize
68KB

MD5
7f5422f2a4fe58b2570d3cb2cc7d2ab2

SHA1
26fc4f17564cf81bb16eefdbec0691a9521053cb

SHA256
61a2bc9e446a3d94df0ae05770d05c12a9534955cb381fbebff1c1b0abfab6f7

SHA512
b2122361bf791c91255de698e369d638b6b1aef0f427eb8f81c88dfcb43920dad3a0fc6951b809dc36d41dffc9da84ab3a00251a629bb30651ea4e844bbe6226

Download Submit
memory/2156-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-1-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download