80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe
Size

1.2MB
MD5

9390f99af9805fbd945ac043b35208ac
SHA1

fd1b941d427f71874f161626a550c883d9c2c4eb
SHA256

80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d
SHA512

59fdfa8469a62dbce80f2e134ba3d53a02c1d7667b30bba1467ace47ee21caf23b149e47a0fe0e7790309d2b4e7872dc6615ed3a664e6de10b9dd1096a9e9920
SSDEEP

24576:Etb20pkaCqT5TBWgNQ7aQiCTbIk9/G3OFSkhn6A:tVg5tQ7aQi4rFl5

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 3644	4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe
3644	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe
4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe
4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3644	4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe	83
PID 4012 wrote to memory of 3644	4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe	83
PID 4012 wrote to memory of 3644	4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe	83
PID 4012 wrote to memory of 3644	4012	80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe	83

C:\Users\Admin\AppData\Local\Temp\80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe
"C:\Users\Admin\AppData\Local\Temp\80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\80875c742d88e7c4a4053371e3812fef3ce8ed5b56e360c013cff6016198a75d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut79D3.tmp

Filesize
282KB

MD5
306dc72dd8c8bcc62297c8b0a5253242

SHA1
529bce387729d4358249888bdbc7b2cc8345fd35

SHA256
af1276faa299d860a939245afb20c598e39b1c64d128fbb3644aeca9aa1ca5e4

SHA512
b935864cd5676a7da70663a0d79fd86790a53e852e2927a936a9c1dce83a39baeba9d5d1e5cdb550af427bb481306c82fa2becc30bf86e4ecf98fa418de2739e

Download Submit
memory/3644-9-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3644-10-0x0000000001700000-0x0000000001A4A000-memory.dmp

Filesize
3.3MB

Download
memory/3644-11-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3644-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4012-8-0x00000000011B0000-0x00000000015B0000-memory.dmp

Filesize
4.0MB

Download