8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rNuevo_Pedido_129149.exe
Size

750KB
MD5

5c64ce5f7c6b88767f77b788a4fb5b19
SHA1

05cf5307feb87910eef79cec65ee8ab1613e28a9
SHA256

8d9cacf5c0689e332f4e043117ecdc533edf1b52b65179885ceb284ff706a6fe
SHA512

25caeddc9d0c42b0ab1d7f6d81303c3b44be9adb3ce5e1ac49f3c78b5cd98c6f05ff07c49c0b79b2d140cb520a0f7bfbf1a7ffe549018417dd1ac44e25c0e045
SSDEEP

12288:AuO/1lVnS6t0bXm0Uf+2Pvmj8vZ8piCM3dj3DcLIPDgMlXZo+LLhz78q6TMmC93V:Q/1lYFLmVft2j15MNj3wLsA+f54qQMmM

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

rNuevo_Pedido_129149.exe

pid	Process
2128	rNuevo_Pedido_129149.exe
2128	rNuevo_Pedido_129149.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rNuevo_Pedido_129149.exerNuevo_Pedido_129149.exe

pid	Process
2128	rNuevo_Pedido_129149.exe
1892	rNuevo_Pedido_129149.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rNuevo_Pedido_129149.exe

description	pid	Process	procid_target
PID 2128 set thread context of 1892	2128	rNuevo_Pedido_129149.exe	31

Drops file in Windows directory 3 IoCs

Processes:

rNuevo_Pedido_129149.exe

description	ioc	Process
File created	C:\Windows\resources\synderegistres.lnk	rNuevo_Pedido_129149.exe
File opened for modification	C:\Windows\resources\synderegistres.lnk	rNuevo_Pedido_129149.exe
File opened for modification	C:\Windows\negotiate\Anstdeligheden.ini	rNuevo_Pedido_129149.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rNuevo_Pedido_129149.exerNuevo_Pedido_129149.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rNuevo_Pedido_129149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rNuevo_Pedido_129149.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rNuevo_Pedido_129149.exe

pid	Process
2128	rNuevo_Pedido_129149.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rNuevo_Pedido_129149.exe

description	pid	Process	procid_target
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31
PID 2128 wrote to memory of 1892	2128	rNuevo_Pedido_129149.exe	31

C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe
"C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe
  "C:\Users\Admin\AppData\Local\Temp\rNuevo_Pedido_129149.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\eksportafgrde.ini

Filesize
38B

MD5
a0d91a2f9acb4dec3b5260aba27839c4

SHA1
8a9037c691a2bdeebcab8bf3d4c954e62aca9207

SHA256
773cd6fba7d53550b4c41aa889e330b744a7a579df2bb02212773b67e72f5844

SHA512
d3df7852aea197e901c787cd8d943faaa30ee9a6678c4853ed0bb494679897854e4e7556f420f1c176443a485cf1e02e0b4bff86f8da4017a053362b2c9a0608

Download Submit
C:\Windows\Resources\synderegistres.lnk

Filesize
838B

MD5
365cb24159845769eb253f3474b50a5b

SHA1
d12407692ce6dbe8d0b1060be1bc0ebe66bf309e

SHA256
f059b61fff3bc4500139bda123ce945f2f754e37cb8e75b9d2047b4548d43d14

SHA512
48ed3b9e5207d08addee7af4005d1c6431a2fd0be07de4980e15c0cb9b5fc431fef6ffade6b71802f1dfc4f68bcbac19b5a01e223ac739d13d0b6092b7017c2d

Download Submit
\Users\Admin\AppData\Local\Temp\nsyD7DA.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
memory/1892-828-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1892-829-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download