16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe
Size

4.2MB
MD5

11ef420ccb6b081a3f8c8d7a920f8800
SHA1

9141c5cbaa568a3a064a1046973307cf9008cdf1
SHA256

16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170
SHA512

f62118093e63abd3dc08ac9ccd7d09726ba3b1c2265d257002d1a3a1b285a20c3f8c35e17e2ff3b9cc5f43ed5082df5d99e2fe110f7036dd539507e2a686f04c
SSDEEP

98304:Cmhd1UryeFNTgO2nC6a/E9y6XLEVLUjH5oxFbxhVLUjH5oxFbx:ClltX2ncE9ykLEVUjZEdhVUjZEd

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2308	C8DB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2308	C8DB.tmp

Loads dropped DLL 2 IoCs

pid	Process
2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe
2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2308	2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe	30
PID 2104 wrote to memory of 2308	2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe	30
PID 2104 wrote to memory of 2308	2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe	30
PID 2104 wrote to memory of 2308	2104	16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe	30

C:\Users\Admin\AppData\Local\Temp\16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe
"C:\Users\Admin\AppData\Local\Temp\16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\C8DB.tmp
  "C:\Users\Admin\AppData\Local\Temp\C8DB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\16b5b00757690e7dbaf2bb627d4f0ae131da378b1ade8a96b752931c0acf9170N.exe 0BCAFBA9888698002A41A70104705BE63084D586065EDD9AD7A86A1EAB2B8FB4FA207DF4E430B68768DCC967F7AD6413F9639BC23CE855B667613B1BF621D69C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\C8DB.tmp

Filesize
4.2MB

MD5
55df7e10b89c5368d9caac5fa66f22b7

SHA1
5cb43c68097872f92d53487b9faae3eaad09daf3

SHA256
469baa748b0489b88d20fd59396f9ae2f251e207958a63792bd2543f2a5beaee

SHA512
c5b3df4f058cd2f7f25076f17830545968307f6ea62935d537e32ed20607f37ff754afe61842509e7267dda6380f8ae868a4c8f92a61c5cf3fe0c3c6e0197e2d

Download Submit
memory/2104-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2308-9-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download