6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
Size

1.1MB
MD5

aa24401d4194debfaebf6efc3276606c
SHA1

34ee3cf6ccae5663a259a99fa9f04ea548bf5885
SHA256

6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a
SHA512

168a35a459db9bb434b7c995a139e04f01034060f78b249d5d6b61027a50ed4332d3497819ef750e80888e555896652a15f0d37bd04a20cb4b621958679d0cc8
SSDEEP

24576:Hb6ZY/l8wkZeHuTjjjgj0jXIG+yVIH/aIeLCgP1ey0ceRQ5W7WQLCvTeiJ25RBly:HOZY/ldkZkuTjjjgj0jXIGpVIH/aIeLJ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Loads dropped DLL 4 IoCs

pid	Process
2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	2808	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2808	2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	31
PID 2716 wrote to memory of 2808	2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	31
PID 2716 wrote to memory of 2808	2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	31
PID 2716 wrote to memory of 2808	2716	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	31
PID 2808 wrote to memory of 2572	2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	32
PID 2808 wrote to memory of 2572	2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	32
PID 2808 wrote to memory of 2572	2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	32
PID 2808 wrote to memory of 2572	2808	6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe	32

C:\Users\Admin\AppData\Local\Temp\6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
"C:\Users\Admin\AppData\Local\Temp\6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
  C:\Users\Admin\AppData\Local\Temp\6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 144
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6e0103c738311e72432ae524ece662a21513f2a76013129edbcfadf22c61412a.exe

Filesize
1.1MB

MD5
34c3ba7f6dbfdb9803d13fb64ab31b64

SHA1
84f0fa754894bef5eb5bd0e5c87903ae8fd2f350

SHA256
995aba63f2a9c6ad483891865fa286fae60e5325e3e5a06475da23e5a467f1ad

SHA512
9f94fd49bbbbce6082447a3505808f3d4cc30cfea3a59d9fe12f2f673fb345863670e769ad8b2766b305523fddb1d4dba86507a8205c8fb384ca7bd16fd17e2c

Download Submit
memory/2716-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2716-8-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2716-7-0x0000000003140000-0x0000000003230000-memory.dmp

Filesize
960KB

Download
memory/2808-10-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2808-11-0x0000000000300000-0x00000000003F0000-memory.dmp

Filesize
960KB

Download
memory/2808-15-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download