e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5b

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe
Size

38KB
MD5

6eef8d7b2edf7f7a7903aaebeda8b700
SHA1

85f438776aecc82590748088fb2b792b8699846e
SHA256

e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5b
SHA512

bb5f921528e098770c94ad308f161667880b05b4cd90e8821fd7ccc54e391438f13a1b539142ff7d07bf034422ad995842b69dd0866fd417eca1b4dbe3c6ecc1
SSDEEP

384:6YwzAbTtITikpqIoxO6kA35c6ubEAPTCLYz+z4GJfblRiAFojdIwMDQOSQClXae4:yAHt0Vu5IrM44TlhZwKQbQClXatP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2152	fireupdater.exe

Loads dropped DLL 1 IoCs

pid	Process
2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fireupdater.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30
PID 2732 wrote to memory of 2152	2732	e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe	30

C:\Users\Admin\AppData\Local\Temp\e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe
"C:\Users\Admin\AppData\Local\Temp\e4057a6f93910ff11bef25ea76bd32a64c57a555df8891eb408553221bf8ed5bN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\fireupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\fireupdater.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\fireupdater.exe

Filesize
38KB

MD5
e32e656a1203e33dc43d04043ef2376f

SHA1
92838a863f1df18dcc0cc96cbe077b79c1e1362b

SHA256
19d701b102f796d77b0faa35fffa5952c7288136d00b6907d1fbae354e9741d9

SHA512
54084438b3d69e16552ab1a5713298e0f93261f31fdf6ebe18c708213347055dbb800280386dea9bb2d61048ca81a9a628d84f946428c9aeabf0e10a87318a11

Download Submit
memory/2152-8-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2732-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download