Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:48

General

  • Target

    e21e3a175e5ee1377352de93663ddb004e6eb4f6ea19bd2a5ad50d40dd781953N.exe

  • Size

    40KB

  • MD5

    115086b7ad8a0f340ed2abb1f7c80360

  • SHA1

    ea04483fcd246b50ac8a18da591ba44c2019f589

  • SHA256

    e21e3a175e5ee1377352de93663ddb004e6eb4f6ea19bd2a5ad50d40dd781953

  • SHA512

    9488873081e2c1e0ab71a2611408ccc80b45c4323725da5d743e18650050be5cd41c455bc455100154fc7219707de879f0186914375804a2355cf1c0f7267268

  • SSDEEP

    768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh2:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYW

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e21e3a175e5ee1377352de93663ddb004e6eb4f6ea19bd2a5ad50d40dd781953N.exe
    "C:\Users\Admin\AppData\Local\Temp\e21e3a175e5ee1377352de93663ddb004e6eb4f6ea19bd2a5ad50d40dd781953N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4056

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\microsofthelp.exe

          Filesize

          41KB

          MD5

          cae656773d14092dfe1d7a48dd4d69b0

          SHA1

          d5210ecd3d7fd94c84c7b834e0e88574edb30ae8

          SHA256

          57c77ea5a9a112a410ae65971a8b7607d06b28618c76fcb3f917637c9afd2808

          SHA512

          08e3c5bbc6bffe363599f589557f15b59b38c404ab6c1e5742cf927ededdfacf16da2c022c1b79afb1def421f3e2a1b7c32ebab5fa1e96a84403d6525e4ba810

        • memory/4056-6-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4560-0-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4560-4-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB