9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe
Size

1.9MB
MD5

8933d513c4537fa6225a66c16c802583
SHA1

8edad7f1fcbebd5dbea4e646bcb0672e367b9728
SHA256

9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637
SHA512

66db7acb5a0a27d5071164ffae27971e3d68f404fc77a89bf4391d1dc1ae9923c6bdb51b08340a41c72cf788f2b16e2044e571cc18b85023674e16bab31df99a
SSDEEP

49152:Qoa1taC070daU/ZwwR5Zf1HtnoiASGhRQxEDMn:Qoa1taC0U/Z5511KZPQKDo

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

83D6.tmp

pid process

4756 83D6.tmp
Executes dropped EXE 1 IoCs

Processes:

83D6.tmp

pid process

4756 83D6.tmp

pid	process
4756	83D6.tmp

pid	process
4756	83D6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe83D6.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83D6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe

description	pid	process	target process
PID 4516 wrote to memory of 4756	4516	9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe	83D6.tmp
PID 4516 wrote to memory of 4756	4516	9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe	83D6.tmp
PID 4516 wrote to memory of 4756	4516	9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe	83D6.tmp

C:\Users\Admin\AppData\Local\Temp\9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe
"C:\Users\Admin\AppData\Local\Temp\9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\83D6.tmp
  "C:\Users\Admin\AppData\Local\Temp\83D6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9d0a097fd9f17f7707d35f358ec77650dac7c5eabdbb81bd3a310f1b4c44b637.exe B3FC7DD4ABFD35C915AA7F99BA3ED1A2FFDF32935DFDEA5378C93F7CA35716A5E4560F987F3DDBFDA13A54C5EE7B0357057BE82A9925F46A9F6448458407B511
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\83D6.tmp

Filesize
1.9MB

MD5
d1829380363b37bf77293a85fa742f26

SHA1
d7c37b9361886ef196bb9824357fa8b60f70bd9f

SHA256
8bdbde90fbcac9418b67e854691fa3fa5c569226730ea459bde02290dc36aefe

SHA512
70b8973f792720830e1413161eab41cbe43e69b3bf91da7c5e9511965c98628279489c7aadf1ad8fb35bf03dc0b3522c630b5992bd4ef6c38d8386207c5984ca

Download Submit
memory/4516-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4756-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download