1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
Size

1.9MB
MD5

51901a93c105bcb072561514ece4aa37
SHA1

6237f1e7ff7de2c0f6eae638efd3acd92bfa4908
SHA256

1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40
SHA512

fdcda112d120d361a58a326663c71e1d1a33832aacf69c7fe96ef08d870d09bd778b75a834fd35075ba71017d718fef89fa2a458a58cf912150ced4183dcf813
SSDEEP

49152:Qoa1taC070dW4zlpQU6tXVS45h0TRcFMCLOvWSL1GYZ:Qoa1taC0tApIVSRgOx1FZ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1540	A72D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1540	A72D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A72D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1540	4988	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	83
PID 4988 wrote to memory of 1540	4988	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	83
PID 4988 wrote to memory of 1540	4988	1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe	83

C:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe
"C:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\A72D.tmp
  "C:\Users\Admin\AppData\Local\Temp\A72D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1439e44c6ea1fa8caa5c30cd9b5df5564907d8a45d9561653121aa82622eed40.exe C54C3621190BBDA34541EA5F8163B62673AC03E1BC09A30926C45D606F8CAAAC9595F6696CFCAC8E4C1627AB1E4571710BBAA64133F77FFC2618AEEEDFCC7C52
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A72D.tmp

Filesize
1.9MB

MD5
2d1c3c354d539ef197fa3d6d54fee6ec

SHA1
e107be818afa8ed60b920c18f006050dcd4db2ea

SHA256
8d0b1f29a6f2b5f4a97fde1429018b11c98758ae52452af6e899993384af544e

SHA512
4d3f4372c80c2ac7901f3ffa17aade29c93fc9bf56c6c58bb5b63e2408b3fb7e436a5c90c4594fd18d9675fb21b809e6286c094eaf1c2c30519892fc1d788c44

Download Submit
memory/1540-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4988-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download