acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8

Analysis

max time kernel
83s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe
Size

1.9MB
MD5

20ebdfc2e1c401532cdec1d3e227d21f
SHA1

7941b21c289913c62331acca66fa4330b4014463
SHA256

acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8
SHA512

c98b3bc884990c767cc643d4ca7a6b60b76da782671b7c3e0a6bc22288fb44643b951df109dfb61afa4421b9c8e303ff20543def70ac4593b7c0f414fa539ccb
SSDEEP

49152:Qoa1taC070dGee7Rx1IEztjAo7ANSYPWGP8HGA4aMXW0:Qoa1taC0NnRx1DjAo7ANSkJ3A4Q0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2708	EDD8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2708	EDD8.tmp

Loads dropped DLL 1 IoCs

pid	Process
2432	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDD8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2708	2432	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	31
PID 2432 wrote to memory of 2708	2432	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	31
PID 2432 wrote to memory of 2708	2432	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	31
PID 2432 wrote to memory of 2708	2432	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	31

C:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe
"C:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\EDD8.tmp
  "C:\Users\Admin\AppData\Local\Temp\EDD8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe 49C08D0F4F1FFFF787F5C38C060FA4387F9118B6F1E03C5B38C436827FF5D9BDB5D2B8314619BD6C2739F4B5E1AEC003C0F17B0A2AF853905247C4C7B708FE44
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\EDD8.tmp

Filesize
1.9MB

MD5
ce6acff19236ddf6bbf1c5ea66ea4c63

SHA1
09f9d1bb67d66eb310433646342488163b66d447

SHA256
511411a8eb6fec7d5718be97ce8a5332382da3d159a5312d4336151caa9511a9

SHA512
d4d1c06ce9b858c3fb762b7f968c341e5f1c1c2d3f3d770b4b6463a4a89f8cc799680e9df72cfb6a96e399226f8bed9c598e6db842b48fdee435d3f4d7fc06df

Download Submit
memory/2432-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2708-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download