0483b0d294c1acf6cec539e7cddd014e31de6de3966fa3c6517877fbd29bfee1

Analysis

max time kernel
92s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice.exe
Size 1.2MB
Sample241120-k8fvtsvala
SHA256 0483b0d294c1acf6cec539e7cddd014e31de6de3966fa3c6517877fbd29bfee1
MD5 dc8839a3d72d69dfa5f5de385cefd816
SHA1 ab2aa0dc6878a3a2a5d47ff7b44b9641c0f3e22a
SHA512 6c9b8fdbcba1d64d231f27870215a529652d92286dba009a3dfc0c017fcd28ab5b526c461e2dee8feafb5e6885027efba3e03b076ace2b800ed33f8a73e75740
SSDEEP 24576:xtb20pkaCqT5TBWgNQ7apR2P+lgqkEYSxqqSZv+xxw6A:CVg5tQ7apRistYS4qSZv+xa5
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3092 set thread context of 4308	3092	invoice.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	invoice.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe
4308	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3092	invoice.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3092	invoice.exe
3092	invoice.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3092	invoice.exe
3092	invoice.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4308	3092	invoice.exe	86
PID 3092 wrote to memory of 4308	3092	invoice.exe	86
PID 3092 wrote to memory of 4308	3092	invoice.exe	86
PID 3092 wrote to memory of 4308	3092	invoice.exe	86

C:\Users\Admin\AppData\Local\Temp\invoice.exe
"C:\Users\Admin\AppData\Local\Temp\invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\invoice.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autAE22.tmp

Path C:\Users\Admin\AppData\Local\Temp\autAE22.tmp
Size 282KB
SHA256 48abb4916684b13ade9000bb7e98f8940f4ab9b946083aa2ae6a502f82306096
MD5 cdc86ab13819cdf026992a69416d2b5b
SHA1 c445c2e89f32be4d94cf42cca4a85b33fda9f750
SHA512 7cf79bcca4fc63b50523fceed4c31a361de0e547cf0832b2f5b341b2db680cf9d74e828db95ebd81813e58f1e54783db41eaf749b28ed67861e5f493190bab2e
SSDEEP 6144:/PB2UIAjhft4iXkTK8me9ebNUY6KOkitwSn3GQ5+KjT2Aynj5yNUd15K2Z:/PB2XEhV3kT99wuY1ORtwSn3f5hja9yY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3092-8-0x0000000001530000-0x0000000001930000-memory.dmp

Download

memory/4308-9-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4308-10-0x0000000001B00000-0x0000000001E4A000-memory.dmp

Download

memory/4308-11-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4308-12-0x0000000000400000-0x0000000000447000-memory.dmp

Download