Analysis Overview
SHA256
98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084
Threat Level: Shows suspicious behavior
The file 98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Indicator Removal: File Deletion
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-13 07:24
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 07:24
Reported
2024-11-13 07:26
Platform
win7-20240903-en
Max time kernel
119s
Max time network
17s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1956 wrote to memory of 1048 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 1956 wrote to memory of 1048 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 1956 wrote to memory of 1048 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 1956 wrote to memory of 1048 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe
"C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe"
C:\Users\Admin\AppData\Local\Temp\cnwog.exe
"C:\Users\Admin\AppData\Local\Temp\cnwog.exe"
Network
Files
memory/1956-0-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1956-1-0x0000000000240000-0x0000000000243000-memory.dmp
memory/1956-8-0x0000000001EE0000-0x0000000001EEC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cnwog.exe
| MD5 | 74fa62de7ccec9f4f9a3bb4a15994b13 |
| SHA1 | e9ebb0ec01c3f47aa7a55ceec7b0ef7dc9034369 |
| SHA256 | 3b4d63c993c1a63bbad22cdfdeb2ec914d34c46a3a9a167f53a500f3cc553f13 |
| SHA512 | f832f124b035bf1de0a9ce7026102f12ec1cf00f5c7c30b80117b4f5a729d7bd71b830a45e6729a8942045197fb97271d917354b4fef7b6a4c73a33d514ee864 |
memory/1048-11-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1956-9-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1048-12-0x00000000003C0000-0x00000000003C3000-memory.dmp
memory/1048-15-0x0000000000400000-0x000000000040C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 07:24
Reported
2024-11-13 07:26
Platform
win10v2004-20241007-en
Max time kernel
93s
Max time network
95s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | N/A |
Indicator Removal: File Deletion
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3060 wrote to memory of 3260 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 3060 wrote to memory of 3260 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 3060 wrote to memory of 3260 | N/A | C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe | C:\Users\Admin\AppData\Local\Temp\cnwog.exe |
| PID 3260 wrote to memory of 4288 | N/A | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3260 wrote to memory of 4288 | N/A | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | C:\Windows\SysWOW64\cmd.exe |
| PID 3260 wrote to memory of 4288 | N/A | C:\Users\Admin\AppData\Local\Temp\cnwog.exe | C:\Windows\SysWOW64\cmd.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe
"C:\Users\Admin\AppData\Local\Temp\98cbc779ca16314ae09fe9f1633ac2b144890f95898153303d038d6847e8d084N.exe"
C:\Users\Admin\AppData\Local\Temp\cnwog.exe
"C:\Users\Admin\AppData\Local\Temp\cnwog.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\cnwog.exe >> NUL
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.208.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/3060-0-0x0000000000400000-0x000000000040C000-memory.dmp
memory/3060-1-0x0000000000590000-0x0000000000593000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\cnwog.exe
| MD5 | 74fa62de7ccec9f4f9a3bb4a15994b13 |
| SHA1 | e9ebb0ec01c3f47aa7a55ceec7b0ef7dc9034369 |
| SHA256 | 3b4d63c993c1a63bbad22cdfdeb2ec914d34c46a3a9a167f53a500f3cc553f13 |
| SHA512 | f832f124b035bf1de0a9ce7026102f12ec1cf00f5c7c30b80117b4f5a729d7bd71b830a45e6729a8942045197fb97271d917354b4fef7b6a4c73a33d514ee864 |
memory/3060-11-0x0000000000400000-0x000000000040C000-memory.dmp
memory/3260-12-0x0000000000400000-0x000000000040C000-memory.dmp