acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe
Size

1.9MB
MD5

20ebdfc2e1c401532cdec1d3e227d21f
SHA1

7941b21c289913c62331acca66fa4330b4014463
SHA256

acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8
SHA512

c98b3bc884990c767cc643d4ca7a6b60b76da782671b7c3e0a6bc22288fb44643b951df109dfb61afa4421b9c8e303ff20543def70ac4593b7c0f414fa539ccb
SSDEEP

49152:Qoa1taC070dGee7Rx1IEztjAo7ANSYPWGP8HGA4aMXW0:Qoa1taC0NnRx1DjAo7ANSkJ3A4Q0

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2944	6EC7.tmp

Executes dropped EXE 1 IoCs

pid	Process
2944	6EC7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EC7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2944	1856	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	83
PID 1856 wrote to memory of 2944	1856	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	83
PID 1856 wrote to memory of 2944	1856	acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe	83

C:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe
"C:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\6EC7.tmp
  "C:\Users\Admin\AppData\Local\Temp\6EC7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\acd8a848d9fad061f1a03c159efbf504b38a65af8c06e05a1455ea2dc1bd63b8.exe BC37637ACD03C4F12D71F05A4C36AF1DB723EDBA9F8D41B1886CE4B2A5ED6B357D33C46987AC403FE665E64F0F144C2133B42ECAD7A571A9FE807C8A9AA244A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6EC7.tmp

Filesize
1.9MB

MD5
3626247338e03b4f7053d26377084704

SHA1
68107b026c5dd1b05a3de15aafa0d44b5f2488e9

SHA256
1ab683d5533d06f950493e22a7d7aeb18d0f0238e9186f79059d99db379848f3

SHA512
76f9486d3c3dd952b938b184eab0c4f8011a7df5a145a8d6b6a2f1482de420f9c6027e65fa97d49bfc14c544f277162ceb647041041ad1bc191852ed04d79d69

Download Submit
memory/1856-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2944-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download