88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d

Analysis

max time kernel
95s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe
Size

816KB
MD5

de02387d363dbe3cd3d3897ac759267c
SHA1

916c5448d062ee43f8086019f3cca61d99af0c5f
SHA256

88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d
SHA512

35af20b65ccd1dc35e676dc6ebbe6d10e8ac9af364c4ee39374b9b0a0a38a1910c0cba51490f02b0980a25cce6cb27e8cc57b18b948f19b3c8734cf4e8fc5df4
SSDEEP

24576:uY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9C:v3XZynV4oDabuWbDQOcIxJJ9C

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

pid	Process
3516	1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

pid	Process
2844	88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe
3516	1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe

description	pid	Process	procid_target
PID 2844 wrote to memory of 3516	2844	88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe	82
PID 2844 wrote to memory of 3516	2844	88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe	82
PID 2844 wrote to memory of 3516	2844	88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe	82

C:\Users\Admin\AppData\Local\Temp\88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe
"C:\Users\Admin\AppData\Local\Temp\88d02ce76aebea94d4a218adf044ff32e476f2a115ab4aa2982fb0573eab006d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\1D0F0B0D120D156E155D15B0F0C160F0D160B.exe
  C:\Users\Admin\AppData\Local\Temp\1D0F0B0D120D156E155D15B0F0C160F0D160B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1D0F0B0D120D156E155D15B0F0C160F0D160B.exe

Filesize
816KB

MD5
48c6f3759b15d7d932a64cd5c766d049

SHA1
33860927bad2910e86f112d964fff8682820b8bb

SHA256
4449209de29f0629411eddf0a108b6888059fc09a55a789d9c9f27c895c6b98a

SHA512
c0cd9f7a6a62cfff54c37b6153200182f3c1ab90b94a714d87912e85e5738bc2508bdf6893f19a95e6ff83837d2c36b8d37df36c77e3ce72f8665c20a27f4539

Download Submit
memory/2844-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2844-1-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/2844-2-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2844-10-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3516-9-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3516-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3516-8-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download