Analysis

  • max time kernel
    90s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 22:57

General

  • Target

    f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe

  • Size

    816KB

  • MD5

    bdb3758cbfb57de3b18c865e22d050ce

  • SHA1

    766422d0c1b530f44c3f97b872962afd646c8cc4

  • SHA256

    f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047

  • SHA512

    1f6e68cc8b21baefd78a807f49824d2d203a06936539127e72f9b76e28e21711c7fdfb866030834d56e62265c592138849b4683d7b7deecc8e247d2399daf460

  • SSDEEP

    24576:EY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9g:Z3XZynV4oDabuWbDQOcIxJJ9g

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe
    "C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Users\Admin\AppData\Local\Temp\1B0D0C0F120F156E155D15D0C0F160F0F160D.exe
      C:\Users\Admin\AppData\Local\Temp\1B0D0C0F120F156E155D15D0C0F160F0F160D.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1B0D0C0F120F156E155D15D0C0F160F0F160D.exe

    Filesize

    816KB

    MD5

    de47ba6f6633c720392e019f9dfb43de

    SHA1

    b38621f9e2449f089fbfd5c3fb9725177422a95c

    SHA256

    cf534f062c808e43569ef5c1662a82796b748cca38b5400bce104b879b745cc9

    SHA512

    05271abb6fda9db414204fb9e7719bfecc11d3bc72205d1895cfa025b4707bdd63d461f1acedecc6c3378950b8bfff5b6d90b86d48de0299dc314fb875e02efc

  • memory/2464-0-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/2464-1-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/2464-2-0x0000000000401000-0x000000000041F000-memory.dmp

    Filesize

    120KB

  • memory/2464-11-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/3016-13-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/3016-15-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/3016-14-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB