1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
Size

1.9MB
MD5

51901a93c105bcb072561514ece4aa37
SHA1

6237f1e7ff7de2c0f6eae638efd3acd92bfa4908
SHA256

1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40
SHA512

fdcda112d120d361a58a326663c71e1d1a33832aacf69c7fe96ef08d870d09bd778b75a834fd35075ba71017d718fef89fa2a458a58cf912150ced4183dcf813
SSDEEP

49152:Qoa1taC070dW4zlpQU6tXVS45h0TRcFMCLOvWSL1GYZ:Qoa1taC0tApIVSRgOx1FZ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2512	B857.tmp

Executes dropped EXE 1 IoCs

pid	Process
2512	B857.tmp

Loads dropped DLL 1 IoCs

pid	Process
1760	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B857.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2512	1760	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	30
PID 1760 wrote to memory of 2512	1760	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	30
PID 1760 wrote to memory of 2512	1760	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	30
PID 1760 wrote to memory of 2512	1760	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	30

C:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
"C:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\B857.tmp
  "C:\Users\Admin\AppData\Local\Temp\B857.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe 9862D3549D655502BD299A0EF1488DB2C0BC2EFC2E3A266A3334EEA1CF6840114AE6870A9CC388D7C99D7A91A784EDE699D09C75AA705EC55EC99B6B8D6F77DB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\B857.tmp

Filesize
1.9MB

MD5
05bae9e6bebea68576be78097101846c

SHA1
3210482240513f14d51f263fee0f5c0199428cb8

SHA256
76b032fe619926a78f33e0ec12ebd3fd812771216ca13e424cdfed10f26f560e

SHA512
378eb52c1721abcbea0daa49ece03d9335607892cf987f6353110d3aed272bd3c9a17f13057c7fe2efc2177596308d78a88df1cbc7892df957d26d7e2a682a69

Download Submit
memory/1760-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2512-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download