Analysis
-
max time kernel
108s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
Resource
win10v2004-20241007-en
General
-
Target
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe
-
Size
46KB
-
MD5
9e1fa03549ebc332a67dcb7ec74ed050
-
SHA1
53deae8f6edc1543f573fb0fbc25dd66bb2739a2
-
SHA256
ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303
-
SHA512
3207f608310e37bae8ba3bcbb18c2e8c4ce02049fef68ac63bcd555ed21ebad7dc5983b24770bb0246fc6e7be7a66896cc2102158a2a11ccb5d431fbac20c53b
-
SSDEEP
768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zO0:bF/y2lFizbR9XwzP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2320 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 2320 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 548 wrote to memory of 2320 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 31 PID 548 wrote to memory of 2320 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 31 PID 548 wrote to memory of 2320 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 31 PID 548 wrote to memory of 2320 548 ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe"C:\Users\Admin\AppData\Local\Temp\ac7d233a89e3cf3d263533868e6f91cb20763cb79f0306fbf5eb8ebe972be303N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD535f71eebc7edb4fa8191a60ad08459d8
SHA19df8fe22dce0444febe9f1c2184bb06dbbde3df2
SHA256e46324d308d73c7925ee51a5932d735801c317809b8db8fcb6cd8bd2fd7e8e45
SHA512f22af04826da8c63460b8b645432af7feebb6617849d74c55facb2f77b0a7d08230882481e09ac6d9677a71229b97a5b1302e4dce1c9f7164db60fb39b1baf37