73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe
Size 689KB
Sample241109-3e96patmax
SHA256 73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01
MD5 323171b075bfbe967b88121d367b3265
SHA1 9684569675ffdc8c6a0e1d585da70863405bb5ef
SHA512 652e0f03d73c6bbf1a3e2e16221ca0634fa5562f7aeeb539dea844660ee2e6146141808eb82449641c41c7af21e4cdf6b2673b05548a86c2fa352f2bc7ed6687
SSDEEP 12288:IgluT689oXcRNE96FRBJubuN8+EncwPsnSbagEE+OAEeY02y8nLH08+:IglI6zX4HFBubuvEc/gEEhAZY02yyf+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	4656	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99
PID 4656 wrote to memory of 3508	4656	73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe	99

C:\Users\Admin\AppData\Local\Temp\73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe
"C:\Users\Admin\AppData\Local\Temp\73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe
  "C:\Users\Admin\AppData\Local\Temp\73ec86a50f5e970981e5205be7e9958270d309c6546aaf59c181e32a8e86bb01.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 160
  2⤵
  - Program crash
  PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3508-3-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3508-4-0x0000000000A30000-0x0000000000AE1000-memory.dmp

Download

memory/3508-5-0x0000000000A30000-0x0000000000AE1000-memory.dmp

Download

memory/4656-0-0x0000000000A89000-0x0000000000A8A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads