5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873

Analysis

max time kernel
94s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe
Size

1.6MB
MD5

e359a279fb538bab57e7767c50fe8cd7
SHA1

33c39f9d05e6010efacb28e895f19603bbbb5fc7
SHA256

5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873
SHA512

882d27648962810b6d985ce61b0d56acc1f54d9134b719650abe8fbb2d482303ed45af33246184627c4ed86dda58372a4bda34807744006a35a7124ccd3241be
SSDEEP

49152:7c2wHll9yp3UZynV4oDabuWbDQOcIxJJSj:42wHl6ta+RDabp8j

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
632	1A0D0B0E120E156B155F15F0D0C160F0E160E.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1940	5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe
632	1A0D0B0E120E156B155F15F0D0C160F0E160E.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A0D0B0E120E156B155F15F0D0C160F0E160E.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 632	1940	5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe	83
PID 1940 wrote to memory of 632	1940	5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe	83
PID 1940 wrote to memory of 632	1940	5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe	83

C:\Users\Admin\AppData\Local\Temp\5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe
"C:\Users\Admin\AppData\Local\Temp\5226226db2c600ef2e74b0550abb61aedc662198255f86e5f0563f9e616a4873.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\1A0D0B0E120E156B155F15F0D0C160F0E160E.exe
  C:\Users\Admin\AppData\Local\Temp\1A0D0B0E120E156B155F15F0D0C160F0E160E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1A0D0B0E120E156B155F15F0D0C160F0E160E.exe

Filesize
1.6MB

MD5
1b8e38f9764c70ef61d3b5d38e685f1d

SHA1
8c89895146ae1d1d4e3b679a745ba0d1c87e6559

SHA256
95da2868e4c5def099073b85c9b3ae825a661bf0e68fd937ee5dfdb2f25b2cd3

SHA512
9f259e602f06274545daa05ac9243605fbb41081e153fe9011ed09fd1519e2bbebdedd93897eba79e3edba74e5a7892fe53f75a23ef6b05587f6f19d883c78ce

Download Submit
memory/632-8-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/632-10-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/632-11-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/632-12-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/1940-0-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/1940-2-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1940-1-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download
memory/1940-9-0x0000000000400000-0x00000000005AC2B4-memory.dmp

Filesize
1.7MB

Download