f3dfc24f465166d35c26f23c30d4d9da5ecf5fdab39dbb01058470e22ab17886

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/11/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
Size

2.2MB
MD5

bda80c569715cb4e427f9408b389238a
SHA1

c1982d58ce154872aced5460cd88b106dfeaa6f7
SHA256

83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4
SHA512

ee31887687504525cfe9b0ac9e079a396ba92819bdfca2eb5259bea8b900a762cf58630cd19dc2fefbffa5253a30344691438cd3d344086ef337247f2247411d
SSDEEP

49152:V5Oxg/TFlCpM/CWKNdDgQbHbJwzF00nVLqk6FzreoZo:V5FFlCi/n4mc7M00nVGkgzrnZo

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2796	123.exe
2504	321.exe

Loads dropped DLL 8 IoCs

pid	Process
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2796	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	30
PID 2980 wrote to memory of 2796	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	30
PID 2980 wrote to memory of 2796	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	30
PID 2980 wrote to memory of 2796	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	30
PID 2980 wrote to memory of 2504	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	32
PID 2980 wrote to memory of 2504	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	32
PID 2980 wrote to memory of 2504	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	32
PID 2980 wrote to memory of 2504	2980	83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe	32

C:\Users\Admin\AppData\Local\Temp\83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe
"C:\Users\Admin\AppData\Local\Temp\83c239daead7fd351924f1580a026cc9c93115adbd9e992a1c65deabbe2701b4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\Temp\123.exe
  "C:\Windows\Temp\123.exe"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\Temp\321.exe
  "C:\Windows\Temp\321.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\321.exe

Filesize
2.9MB

MD5
a774532aea9d069f6fd16a9c84ff66ac

SHA1
c45a9a43ea5810f9b1e2522a9657c43e795b01dc

SHA256
1dcf61a876f7ffd7fd19fe9b81f614f0b0daf2ca80d81f16275680a7e2dae9c6

SHA512
ee09e845d6b889b0fac803468e2f672a1a187abcbc77652e07dcc8301fb05cca25e8121411be11b6e425e36ad851a586724da2e733516f9266493441e804b32c

Download Submit
\Windows\Temp\123.exe

Filesize
515KB

MD5
3fa22b0476827d769e2af472e068dcf2

SHA1
80088e35ee337f66ced69521bacd4045d723127b

SHA256
e640c00779f3df1dd107495414e3498dc347a12fc61142faecd7aba7aa5918d1

SHA512
500c180fea4c68af86284b0f930802f361f827454eb1edc85c02c90e8c74fe937212adcd3c1aff807b841d9f0a92ad4ba8cfdc8fc1cf6fd1e6f5ba15ef75a6f3

Download Submit