Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 11:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe
Resource
win7-20241023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe
-
Size
1.3MB
-
MD5
e76bee932c2fdc46e16bc08c5f37dd14
-
SHA1
5b2af3fc874b0f53821f7ebb0820309b6e28d4cc
-
SHA256
21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de
-
SHA512
514f1c4c9ffb246966297ad55b08ed6ff9643f9517c185bb1dcf776027e022d867f79807ff3540c111638792ebc1b3681cc7a47779616ddef613b4b2eb6df5c6
-
SSDEEP
24576:o8KZrcDecGvUusSVRyxDnl2BKprq3YO7/IUJz8G3urq:o8ZoUKRyVcUprCtISgDu
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4808 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 82 PID 3496 wrote to memory of 4808 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 82 PID 3496 wrote to memory of 4808 3496 21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe 82 PID 4808 wrote to memory of 2136 4808 cmd.exe 85 PID 4808 wrote to memory of 2136 4808 cmd.exe 85 PID 4808 wrote to memory of 2136 4808 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe"C:\Users\Admin\AppData\Local\Temp\21cce53c439bc4beec965a34184d1dfa20520ee60cff74b1114b4698d7a8d0de.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.execmd /c nslookup -qt=txt quellgtaver.mageangela.cn >C:\Users\Admin\AppData\Roaming\\MageAngela\QuellGTA\nsVer.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=txt quellgtaver.mageangela.cn3⤵
- System Location Discovery: System Language Discovery
PID:2136
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87B
MD5a9574e8b6423a0bcba49738791dcb2e3
SHA1414959e434f33f0aec22577ef6951d21441b97cc
SHA2565984bef8489858aea912a4a37755534105e5f4cc863cf55e2b9a218037b1110d
SHA5122ff4473341f2a63da29c02569a3069c61fbe82f3b2bcfbebd2fd2ffeb21477a28090b0be7e314ce590971ed9579ca385141a099a74705dc79bd1fc700d406b2c