88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
Size

224KB
MD5

c6509b96aa39f74e0bbdddd353e1f73f
SHA1

0c1d3279c7e25e7d70f90335acb19d7ab5d27ffd
SHA256

88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab
SHA512

26674b97815bdccb6ce700c81be249b3a0ba213208f7ed0d6efde674113d5817b81299c713fe01530724afefec7717a93980fd57eefd26891187523417b02153
SSDEEP

3072:6aC/ozTJ9vwdSJT+IkAf+5UjJRbrw6wWDdFqFPnUK/TvsEv//ntF+zWqCV76Mzha:FC/KTXod3uQcRb3VkvFnnj+zi6Mdyik

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

wlan_test.exe

pid process

2836 wlan_test.exe

pid	process
2836	wlan_test.exe

Loads dropped DLL 5 IoCs

Processes:

88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe

pid	process
2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe

description	pid	process	target process
PID 2980 wrote to memory of 2836	2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe	wlan_test.exe
PID 2980 wrote to memory of 2836	2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe	wlan_test.exe
PID 2980 wrote to memory of 2836	2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe	wlan_test.exe
PID 2980 wrote to memory of 2836	2980	88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe	wlan_test.exe

C:\Users\Admin\AppData\Local\Temp\88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe
"C:\Users\Admin\AppData\Local\Temp\88065e1cf38a7c3a48c8a3d0de61bb2bd1167c65187074a3cd3ea269fe4c4dab.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\wlan_test.exe
  C:\Users\Admin\AppData\Local\Temp\wlan_test.exe
  2⤵
  - Executes dropped EXE
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjE976.tmp\LangDLL.dll

Filesize
8KB

MD5
e5240dcd169abe69a7332d01106e1d84

SHA1
2ca68892501102586f6ab4eb99744d7f6138c166

SHA256
96c40847d52270061c25743bc9ec4843be1991f3ac36c2d1b78ec04a04437ea4

SHA512
519479d1c6bfd4fcb11e0802f9cf5eb7b324577514a986f0fdf07d33ff6a275dc5ac41654aed818d1c30e0bdda543297f4b7886442cbc93066a808cafbaf8a70

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE976.tmp\System.dll

Filesize
29KB

MD5
26c8a92678f1b970ac2a700bb844c309

SHA1
c821a5980c31b0b35f1505cde836d6769f45e3a3

SHA256
2a7b5d1cab96a5280b0694d0ed54510129626a1ba36a51bd34d546972b7d18b8

SHA512
fba6e371853fd6c27097eb7cce7ffc59d71e4f0a9b5e55de06472d094b70c44a409bd82f39d9a27a814e826ab8468c59e947401a3c3ead1f057cbac236588860

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE976.tmp\nsArray.dll

Filesize
12KB

MD5
da4bc09439ed21faf7620a53433aac92

SHA1
94e3347aebe16cb88b9f29f00134d9e0fb67e508

SHA256
216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0

SHA512
920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE976.tmp\nsExec.dll

Filesize
11KB

MD5
7c0dc12cdc807a3bb4afda989a663f95

SHA1
3db74d921bd68ce73834de4636bbec03b21723ff

SHA256
0d022cc0aa60a3f41dbeb6776e9acb016ff3d42396e3371f15cc22352e621eb5

SHA512
22301b351c0332fce7b0d6b21e2b1dc9a850658b8ac610bfa4fb9d02adfbdad30211f04edcabd4141574d243cb6333ef78adb6647860641c84e5d6dc6f635a20

Download Submit
\Users\Admin\AppData\Local\Temp\wlan_test.exe

Filesize
8KB

MD5
40bca6124fa7eef106c0d76c428d9471

SHA1
dadd29d90007602be8ecd18406dc28634d0bbb2d

SHA256
fc03209d76e6c41c11dde8621f1eb03ff348a12566cb9b63e7aa2d6cef8086aa

SHA512
5167d2bbe094dc7a3ecf89e508ae869dcff08c4159b7756cb03c2f5431e084ff34d1834e5294892f81f00e96664a67081d8212dde310f553a7f6237a1144a5be

Download Submit
memory/2980-38-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download