6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
Size

1.9MB
MD5

7baed40faa2f7e55570b489be8770533
SHA1

4f1bc2c576c3741c1a7317c8bf54159b3756fc66
SHA256

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00
SHA512

9e7051b5b66dc574d92a7b62245f728300278e3fc113bf2350f85aa733153b3f1dc87cb5f99c4fb1f47e8ed0908a666f2cdd42b3d043c4b77bd1756880fc42aa
SSDEEP

49152:Qoa1taC070dBM8Vt48hRqu6HFfEhzLfTaMyhO:Qoa1taC0581PquQEhzLrQI

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

8E46.tmp

pid process

4908 8E46.tmp
Executes dropped EXE 1 IoCs

Processes:

8E46.tmp

pid process

4908 8E46.tmp

pid	process
4908	8E46.tmp

pid	process
4908	8E46.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe8E46.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E46.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe

description	pid	process	target process
PID 1048 wrote to memory of 4908	1048	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	8E46.tmp
PID 1048 wrote to memory of 4908	1048	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	8E46.tmp
PID 1048 wrote to memory of 4908	1048	6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe	8E46.tmp

C:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe
"C:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\8E46.tmp
  "C:\Users\Admin\AppData\Local\Temp\8E46.tmp" --splashC:\Users\Admin\AppData\Local\Temp\6fcf11621e81fa7ae7b0adc5a8a49e74518bc2da69d75245295b18d6f32eda00.exe B18CCD716CA9C3071480FB1BB2FC827FDD512742349D8AA14192475D559DA1C7DD496EF06E971DE171C26C430FC8AAD1EF390F64F306481D1E64F21C6897286C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8E46.tmp

Filesize
1.9MB

MD5
80cf98fcb6df1bb175fd428c9870016c

SHA1
0dc30716c7010876d02208a5b0ce32f7afe718a0

SHA256
8146bd1a7093f9c94fd16579eebcb9f1a6078624f057afc741c9536cfdd98a8e

SHA512
5b5100ec1c97d0ddbb928e716d6d63e9aab63fabbca817b4b13939c55a703122d0a48a24f2cdad48768132c11d811bda2ff973be1bb33c93b466f6a00e08d224

Download Submit
memory/1048-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4908-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download