Analysis
-
max time kernel
90s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe
Resource
win10v2004-20241007-en
General
-
Target
f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe
-
Size
816KB
-
MD5
bdb3758cbfb57de3b18c865e22d050ce
-
SHA1
766422d0c1b530f44c3f97b872962afd646c8cc4
-
SHA256
f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047
-
SHA512
1f6e68cc8b21baefd78a807f49824d2d203a06936539127e72f9b76e28e21711c7fdfb866030834d56e62265c592138849b4683d7b7deecc8e247d2399daf460
-
SSDEEP
24576:EY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9g:Z3XZynV4oDabuWbDQOcIxJJ9g
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3016 1B0D0C0F120F156E155D15D0C0F160F0F160D.exe -
Loads dropped DLL 2 IoCs
pid Process 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 3016 1B0D0C0F120F156E155D15D0C0F160F0F160D.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B0D0C0F120F156E155D15D0C0F160F0F160D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2464 wrote to memory of 3016 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 30 PID 2464 wrote to memory of 3016 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 30 PID 2464 wrote to memory of 3016 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 30 PID 2464 wrote to memory of 3016 2464 f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe"C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1B0D0C0F120F156E155D15D0C0F160F0F160D.exeC:\Users\Admin\AppData\Local\Temp\1B0D0C0F120F156E155D15D0C0F160F0F160D.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5de47ba6f6633c720392e019f9dfb43de
SHA1b38621f9e2449f089fbfd5c3fb9725177422a95c
SHA256cf534f062c808e43569ef5c1662a82796b748cca38b5400bce104b879b745cc9
SHA51205271abb6fda9db414204fb9e7719bfecc11d3bc72205d1895cfa025b4707bdd63d461f1acedecc6c3378950b8bfff5b6d90b86d48de0299dc314fb875e02efc