7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
Size

1009KB
MD5

5b9520cdce201fecd22a108edc4b9927
SHA1

6afb7c1ee328ec47ff4aabe5a19cd2d26ab54c1f
SHA256

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d
SHA512

73e30d7e7f6519216f96638b025f4ce844c11ee90176bb4c49a0923b63423b246f22638db2c5bf61d7c874203edabdd7d4fdd0c651bfdf7b17311278fc67d750
SSDEEP

12288:l0g77CaJ/85VedbvaOvTks8Eac9Q7RS3iDpDUJMDVb8hAvaiKz4R39HzIluzTB:PCm85VwaOLkTjcGciDUJ2bsV21IAJ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

pid	process
1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Drops file in Windows directory 2 IoCs

Processes:

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

description	ioc	process
File opened for modification	C:\Windows\realisme.ini	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
File opened for modification	C:\Windows\resources\0409\busher.Hed	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 1728 WerFault.exe 7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

pid	pid_target	process	target process
2460	1728	WerFault.exe	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe

description	pid	process	target process
PID 1728 wrote to memory of 2460	1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	WerFault.exe
PID 1728 wrote to memory of 2460	1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	WerFault.exe
PID 1728 wrote to memory of 2460	1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	WerFault.exe
PID 1728 wrote to memory of 2460	1728	7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
"C:\Users\Admin\AppData\Local\Temp\7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 488
  2⤵
  - Program crash
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\realisme.ini

Filesize
36B

MD5
54098ab42483d0d9baafb98e754befed

SHA1
e355e59f79fcd4f5e2c8916a1009e6ac36788c9b

SHA256
37863e9da60268fc68e1c602ee02fed62705704ba3bf1c2e607e0cfe22487d22

SHA512
c960a4365b12b92bbf89d62492db50c79ded4523c9ec86c38dd3fdb2050f1d68caa42d4572d86f2e03069f3e3c638769a4b8d1269de2391c22fde996c3ad2fbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE5DD.tmp\System.dll

Filesize
11KB

MD5
34442e1e0c2870341df55e1b7b3cccdc

SHA1
99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

SHA256
269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

SHA512
4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

Download Submit
memory/1728-25-0x0000000002EF0000-0x0000000005032000-memory.dmp

Filesize
33.3MB

Download
memory/1728-26-0x0000000002EF0000-0x0000000005032000-memory.dmp

Filesize
33.3MB

Download