6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
Size

1.9MB
MD5

7baed40faa2f7e55570b489be8770533
SHA1

4f1bc2c576c3741c1a7317c8bf54159b3756fc66
SHA256

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00
SHA512

9e7051b5b66dc574d92a7b62245f728300278e3fc113bf2350f85aa733153b3f1dc87cb5f99c4fb1f47e8ed0908a666f2cdd42b3d043c4b77bd1756880fc42aa
SSDEEP

49152:Qoa1taC070dBM8Vt48hRqu6HFfEhzLfTaMyhO:Qoa1taC0581PquQEhzLrQI

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

A209.tmp

pid process

2956 A209.tmp
Executes dropped EXE 1 IoCs

Processes:

A209.tmp

pid process

2956 A209.tmp
Loads dropped DLL 1 IoCs

Processes:

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe

pid process

2528 6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe

pid	process
2956	A209.tmp

pid	process
2956	A209.tmp

pid	process
2528	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exeA209.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A209.tmp

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe

description	pid	process	target process
PID 2528 wrote to memory of 2956	2528	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	A209.tmp
PID 2528 wrote to memory of 2956	2528	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	A209.tmp
PID 2528 wrote to memory of 2956	2528	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	A209.tmp
PID 2528 wrote to memory of 2956	2528	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	A209.tmp

C:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
"C:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\A209.tmp
  "C:\Users\Admin\AppData\Local\Temp\A209.tmp" --splashC:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe C89763903B6BB1B1CFBAA8343C3103614D240F1B9824207AE8AC707499055F94ED0CE99D73F33CD361BE5F661D9A5AA0F671AF275D87ECB0140EFEAF02A46107
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\A209.tmp

Filesize
1.9MB

MD5
08c398f07593bcbe905c2e415e0b5510

SHA1
430f9b61d2b9e2c271b0b6b0ae5ab90ede382216

SHA256
0ba670e8544d06b995e575b19a105d74721cfcfd25d2ad818563200016ea95d3

SHA512
5603b6af53a7a5c308f523e317b2dcd52e9cf8dafd78004566572f903f73025f84c4c0cdfe666c62c08a3c5c192b9e9a51ee866c0752352f7c9f6c1762b1e576

Download Submit
memory/2528-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2956-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download