Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 22:57

General

  • Target

    f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe

  • Size

    816KB

  • MD5

    bdb3758cbfb57de3b18c865e22d050ce

  • SHA1

    766422d0c1b530f44c3f97b872962afd646c8cc4

  • SHA256

    f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047

  • SHA512

    1f6e68cc8b21baefd78a807f49824d2d203a06936539127e72f9b76e28e21711c7fdfb866030834d56e62265c592138849b4683d7b7deecc8e247d2399daf460

  • SSDEEP

    24576:EY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9g:Z3XZynV4oDabuWbDQOcIxJJ9g

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe
    "C:\Users\Admin\AppData\Local\Temp\f49012f05037fab3785f3d6bc770f811b3428094a38d734a2379598709161047.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Local\Temp\1B0E0E0B120C156C155B15F0E0C160F0A160A.exe
      C:\Users\Admin\AppData\Local\Temp\1B0E0E0B120C156C155B15F0E0C160F0A160A.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1B0E0E0B120C156C155B15F0E0C160F0A160A.exe

    Filesize

    816KB

    MD5

    496556b5aec7c535ae009ae4fbb62b74

    SHA1

    ea25fa6dc28dba3bed21816cbbf99c691c4eec87

    SHA256

    1b838c6112b784c748da44e9ccb860511d0a6b185c4e2226d4eb4f95a72cd979

    SHA512

    67a76f2dcc63cb1276c258c07695b8c4a8e2eb864e371c0a0a3dae878da0ad8a49b295aa2aa4367d0f8798b501f8432858d464029943843314e99114b941c02b

  • memory/3664-0-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/3664-2-0x0000000000401000-0x000000000041F000-memory.dmp

    Filesize

    120KB

  • memory/3664-1-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/3664-7-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/4712-9-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/4712-11-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/4712-10-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB