0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe
Size

1.6MB
MD5

50406ccd579d2983171a078c8dd18cec
SHA1

081d8e3375fe2b72344e08c59c4e531ba6ac2cac
SHA256

0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df
SHA512

f6648a444a1d6d98c52f1fdf358ed41be3dc756f18c5ef387c5822b9a3eef974b4318e33074ec5b4134d523a99f69fc1b666d8528b3873060c25c2e50be45c50
SSDEEP

49152:Mc2wHll9yp3UZynV4oDabuWbDQOcIxJJS:v2wHl6ta+RDabp8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2444	1D0D0F0A120D156B155B15F0E0C160D0B160E.exe

Loads dropped DLL 2 IoCs

pid	Process
2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe
2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe
2444	1D0D0F0A120D156B155B15F0E0C160D0B160E.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D0D0F0A120D156B155B15F0E0C160D0B160E.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2444	2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe	30
PID 2536 wrote to memory of 2444	2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe	30
PID 2536 wrote to memory of 2444	2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe	30
PID 2536 wrote to memory of 2444	2536	0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe	30

C:\Users\Admin\AppData\Local\Temp\0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe
"C:\Users\Admin\AppData\Local\Temp\0e7b569b481d0cfac64497f442a45fcec14667c3fd197e3cab3808eab55df0df.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\1D0D0F0A120D156B155B15F0E0C160D0B160E.exe
  C:\Users\Admin\AppData\Local\Temp\1D0D0F0A120D156B155B15F0E0C160D0B160E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1D0D0F0A120D156B155B15F0E0C160D0B160E.exe

Filesize
1.6MB

MD5
1ca7ad7890a62cc81789adb5192edfa2

SHA1
7992d18097718019f877d963a6a3847a4f869e32

SHA256
a6ae8cd3dc2f243a1d1a95dc4e462f50d2099a75903e17e876c68da00aaa05d0

SHA512
eff365cb00ec3c4711fe9db3555a9a3b96b18b189e0efa674f32f27629fff331f2599992e566dbe84beffa08319a0ac470c030a5e872086b065bcd24d5707d02

Download Submit
memory/2444-15-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2444-16-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2444-17-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2536-0-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2536-1-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/2536-2-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2536-13-0x00000000020F0000-0x000000000229D000-memory.dmp

Filesize
1.7MB

Download
memory/2536-12-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/2536-11-0x00000000020F0000-0x000000000229D000-memory.dmp

Filesize
1.7MB

Download