Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe
Resource
win7-20240903-en
General
-
Target
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe
-
Size
25KB
-
MD5
58f36f67134fcac45149c01bacc53ca0
-
SHA1
b973ce2097c356c3a2452ea4ceb006a0ca3d9817
-
SHA256
0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00d
-
SHA512
aba0a933276968e9b2a06ff4fca0b6e98461bbaeddd15e11388b24fffe5301ca2f9b91ad5ed0dc58743e75a2fb87cf1046322c73d4cf102bd9e91d213c0fccfc
-
SSDEEP
768:me3D5dhwrf3Nw1XJqBtYdanwVqyoTcGqwfZJ:me3V3wrf3N87ocdGVZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4068 NWC.EXE -
resource yara_rule behavioral2/memory/1360-1-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4068-7-0x00000000001C0000-0x00000000001CE000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\NWC.EXE 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe File opened for modification C:\WINDOWS\NWC.EXE 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4412 4068 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4068 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 83 PID 1360 wrote to memory of 4068 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 83 PID 1360 wrote to memory of 4068 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 83 PID 1360 wrote to memory of 3024 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 90 PID 1360 wrote to memory of 3024 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 90 PID 1360 wrote to memory of 3024 1360 0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe"C:\Users\Admin\AppData\Local\Temp\0ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00dN.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\WINDOWS\NWC.EXEC:\WINDOWS\NWC.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 2643⤵
- Program crash
PID:4412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sys.bat2⤵
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 40681⤵PID:4236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
259B
MD51c14c9f3df6eec3d4da6223c2105249d
SHA12779a4f686a0c33eef723710c45f5e38dd9fd69c
SHA256c3cfa5bc5aac47ce0b6e8601471e69c0343538d855d4054aece63833915ccec5
SHA5124c08d021e797bbab0c8ab50f2ef585858cd537ecb85229d8f5978075f13f8f70f2afa5d0680a2a18adbcb7ae92096aa6f048af06203e197998dd1165ed2c927d
-
Filesize
25KB
MD558f36f67134fcac45149c01bacc53ca0
SHA1b973ce2097c356c3a2452ea4ceb006a0ca3d9817
SHA2560ba9f200b9220fe05159c97876bb824e102364720db53b5608db95192359d00d
SHA512aba0a933276968e9b2a06ff4fca0b6e98461bbaeddd15e11388b24fffe5301ca2f9b91ad5ed0dc58743e75a2fb87cf1046322c73d4cf102bd9e91d213c0fccfc