Analysis
-
max time kernel
80s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 11:05
Static task
static1
Behavioral task
behavioral1
Sample
4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe
Resource
win10v2004-20241007-en
General
-
Target
4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe
-
Size
1.8MB
-
MD5
aaa1151dafc7b710bae2335e9e5f8e40
-
SHA1
d44745213115d76814745c1f9c7394377493d507
-
SHA256
4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7
-
SHA512
cdcaa115a22996ccd196af210d3f5a4fec9dd06c9215c4bc2e0cb36d8f505ba321cf6e44b49760760aa2390e10ca58ecd5299c7a67da0682904a615298a3addf
-
SSDEEP
49152:YSGwG9ejgfVL4xl2zWgPyeBhbq4TTow+lsg:YKAL472hyeBhhTW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1728 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Executes dropped EXE 1 IoCs
pid Process 1728 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Loads dropped DLL 1 IoCs
pid Process 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1728 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1728 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1728 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe 32 PID 2452 wrote to memory of 1728 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe 32 PID 2452 wrote to memory of 1728 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe 32 PID 2452 wrote to memory of 1728 2452 4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe"C:\Users\Admin\AppData\Local\Temp\4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exeC:\Users\Admin\AppData\Local\Temp\4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\4782d811b18957a8e641a22b19f3c02df9ae656524749d52f2d23fc430c8eba7N.exe
Filesize1.8MB
MD5d0f8895aced2e1cc29bbf9df9774e385
SHA1cc9ec956c5c8a778ec4e6f939e4e58b5877e4c07
SHA256ba14bcc4576b66813f0439ce61016ddcb11c747c5ba164f0ef7574c0aba9793b
SHA512471a3b80211478d52775f67cf62cf7c15c5df65169c3e2f2961529e7c2b5d966cbc86df03f2eb03494c81a135d587d0cdb28f7033816d84ba7cfca5a7b858f07