Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 10:59

General

  • Target

    aa5bebfd0ab5fed71550c12b5e289b2c48740b38159e02647a0436f182601732.exe

  • Size

    47KB

  • MD5

    2678a48f93135c5b8027af105bb6cebf

  • SHA1

    8be429b902d71d201dfc342159966886f9ce14c6

  • SHA256

    aa5bebfd0ab5fed71550c12b5e289b2c48740b38159e02647a0436f182601732

  • SHA512

    feda1dbe00987ceab99b069e52f0c53ec11bee22ed5d735448124076823f38c486db01b5155def6223caaba074bb12684033af9566c23227168c94fd4044716c

  • SSDEEP

    768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhR:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa5bebfd0ab5fed71550c12b5e289b2c48740b38159e02647a0436f182601732.exe
    "C:\Users\Admin\AppData\Local\Temp\aa5bebfd0ab5fed71550c12b5e289b2c48740b38159e02647a0436f182601732.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3596

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\microsofthelp.exe

          Filesize

          47KB

          MD5

          665616323c15cb52a66d7579129104b3

          SHA1

          5a99f450f406233c9de14c0707f126f1fccb4d39

          SHA256

          1756835ca966f8166a053328db6836d0794b6d87750b077be58b1dc55ff1a2e6

          SHA512

          be301d754bef437adf212bfc16dbbe3ea96c9e8e01a2f38ab4ae1e8fc841dea111ce65c24a118c9f2017d8259abffd6a1e78631aa17cedb5b1caa31dc780d1d6

        • memory/3596-6-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4940-0-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4940-4-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB