Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 10:36
Behavioral task
behavioral1
Sample
b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe
Resource
win7-20240903-en
General
-
Target
b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe
-
Size
2.6MB
-
MD5
a80b1891a09782d6eabba392870ee3c0
-
SHA1
6f419efadbb36a751577e8cd596bb137f702bc54
-
SHA256
b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65a
-
SHA512
ebc28243128ae3f29c9d29996ea40eee7418b1f105b3d816b71e6f6f7d4a96fd6fe30e6970359dacbc0adacd340cbd3dfcbae40318f1c79c5cba94229512ef41
-
SSDEEP
49152:RSoJIbUiqm0FgNGheyc5ylrizXwEmoiPBnr0rnstay3:QoswCTpix6m3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2332 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
Executes dropped EXE 1 IoCs
pid Process 2332 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
Loads dropped DLL 1 IoCs
pid Process 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
resource yara_rule behavioral1/memory/2052-7-0x0000000000400000-0x0000000000D9E000-memory.dmp upx behavioral1/files/0x000a00000001225c-11.dat upx behavioral1/memory/2332-22-0x0000000000400000-0x0000000000D9E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe 2332 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2332 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe 30 PID 2052 wrote to memory of 2332 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe 30 PID 2052 wrote to memory of 2332 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe 30 PID 2052 wrote to memory of 2332 2052 b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe"C:\Users\Admin\AppData\Local\Temp\b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exeC:\Users\Admin\AppData\Local\Temp\b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\b68929b63a4c3f8a3ddebfccee4a8a3053ea93fdd7b205717a00605e7fbee65aN.exe
Filesize2.6MB
MD5d23df225b88ea1dc913fbf1bb508ce99
SHA179fb699f932a34609b344f3ad9d9bca36333e750
SHA256dcb8623d31bef39e5098bfca717690f30fc791e7483097889b2ef095dd97297d
SHA512dfead1be5e61f0ba249f7a220113326ba5ee84bbe3516802d68f1fdfe6472b6edbd539c3889e3cfbb7ca22f0f538b1084e9a12fe40eb58aad45cd9eccab7daa6