56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe
Size

1.9MB
MD5

d9e65f0353d062ba41d1eaea340539d7
SHA1

5371691373a0656692f71ae94ffba8eb25c3c075
SHA256

56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a
SHA512

5bbd8a4adae5f022d38073b3d0109de2b4dcf7a222863331a0aeb02d78e2573a1bc2663db865a444f044d345da9ab1700bba5fc085867b3d2d29d957ba76e96d
SSDEEP

49152:Qoa1taC070d3tM/i6cd5PG33Q6lk4O047P7z+9T:Qoa1taC0T/ix3GnVlk4O047zzuT

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1632	D1D0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1632	D1D0.tmp

Loads dropped DLL 1 IoCs

pid	Process
1152	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D1D0.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1632	1152	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe	31
PID 1152 wrote to memory of 1632	1152	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe	31
PID 1152 wrote to memory of 1632	1152	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe	31
PID 1152 wrote to memory of 1632	1152	56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe	31

C:\Users\Admin\AppData\Local\Temp\56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe
"C:\Users\Admin\AppData\Local\Temp\56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\D1D0.tmp
  "C:\Users\Admin\AppData\Local\Temp\D1D0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\56ca171eccc470527267b9a307cff2a65ef80c9ccbc9d2b0b06aba17a46e0e9a.exe 5EA7B772700E32040265CF07ECD3C3573AC3242FB09C69D0F724323BA311F9DA20ED5804B9943B1CDCC2E64BEBA885A02F6D6E605C8620528CC0E8FD29560A3C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\D1D0.tmp

Filesize
1.9MB

MD5
01f8f9908379ef5f594febcb4cc57daa

SHA1
b20029dea545c2cb46a6c10a7258c13cdbd6c23d

SHA256
783e03e3e880666b28ccebd7b76ed9dbfa89f25ad59634a15f78d388becbbf74

SHA512
b3b6c7169d2a099f7ed6044bf7e47fcf799587938b7cbbed5d9e1d0d123659765751ca590404c25268a2716145d6d8043f98fef239d3bf85964001d353b77bf6

Download Submit
memory/1152-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/1632-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download