0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe
Size

1.1MB
MD5

63423a62f17c124b20dada41cf15152c
SHA1

2229f17714173db041eb21e3671ebede60fc3086
SHA256

0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4
SHA512

fab6c85823b8cf83bc4df43ec49b6fa158b409db0774de23b62e34d20ea2a0389a4f607f70e85ab06e46a5efba15accc0ff9cee496ec34940ec89e3db81dd0c0
SSDEEP

24576:etb20pkaCqT5TBWgNQ7aR9IQPlZThfkeyxUmMn6Au:LVg5tQ7aR9nZT9keyC35u

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1396	svchost.exe
1396	svchost.exe
1396	svchost.exe
1396	svchost.exe
1396	svchost.exe
1396	svchost.exe
1396	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31
PID 1628 wrote to memory of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31
PID 1628 wrote to memory of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31
PID 1628 wrote to memory of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31
PID 1628 wrote to memory of 1396	1628	0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe	31

C:\Users\Admin\AppData\Local\Temp\0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe
"C:\Users\Admin\AppData\Local\Temp\0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\0acc17fc2414715aae74c8bd50e706b0382d4cd0826c3ca3bb709e7846af4ba4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\reaffection

Filesize
282KB

MD5
3019ea79665a3499278baf8aa9ad9dad

SHA1
6b43d243924bc03f3ef2c4b0af48cc78381b89c8

SHA256
05bf4edb940c91d7360cd4c875b2cb0405e3a18df39a7484e478adfa2c2aefeb

SHA512
1674fd28f2076d08fdd80407ab4a1028d351bd3ecf52da29e8209ea1c6e4abe0f6a7d2b4145c94440716403eb44ebf8032173bd0653e01a53d505bb303c8403b

Download Submit
memory/1396-13-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1396-14-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1396-15-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/1396-16-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1396-17-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1628-12-0x0000000000FE0000-0x00000000013E0000-memory.dmp

Filesize
4.0MB

Download