f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/11/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDWCH2.exe
Size 739KB
Sample241108-b33b7svmcm
SHA256 b64cc3011b334fe3fdc47852da28f1d865a1f71dd819827a035b9b3adab1a163
MD5 0d5cc91890c411599e994ab4d927350b
SHA1 b64c4752537fc05bd460918fe252ef64e72d2651
SHA512 56418a6586f0cc7f985e944811744fdce2ddaea5e238d02b21435768a3738ba7cccc738190b677f0eb66916a24cdcd4b63701df8a35c7a44802ba053ccdf059b
SSDEEP 6144:d/QiQXC45m+ksmpk3U9j0IeP2soxvjFEOTb9WmZX/8shzdsY4CpHPhnq/FK:VQi34c6m6UR0IeP2p1hf39Wkv8xwJqdK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2924	IDWCH2.tmp

Loads dropped DLL 4 IoCs

pid	Process
2788	IDWCH2.exe
2924	IDWCH2.tmp
2924	IDWCH2.tmp
2924	IDWCH2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDWCH2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDWCH2.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31
PID 2788 wrote to memory of 2924	2788	IDWCH2.exe	31

C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe
"C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\is-T71R7.tmp\IDWCH2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T71R7.tmp\IDWCH2.tmp" /SL5="$5013A,506127,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-IV4GM.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path \Users\Admin\AppData\Local\Temp\is-IV4GM.tmp\idp.dll
Size 216KB
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
SSDEEP 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDWCH2.tmp

Path \Users\Admin\AppData\Local\Temp\is-T71R7.tmp\IDWCH2.tmp
Size 1.0MB
SHA256 c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
MD5 6020849fbca45bc0c69d4d4a0f4b62e7
SHA1 5be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA512 f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
SSDEEP 24576:nQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafKyx9DQ:Z02rPD37zzH2A6SBIfNafPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2788-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2788-3-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/2788-25-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2924-8-0x0000000000400000-0x0000000000516000-memory.dmp

Download

memory/2924-23-0x0000000000400000-0x0000000000516000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads