1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe
Size

1.9MB
MD5

0fb37b475a95aff4292fcad137af3d95
SHA1

2978be208a3cc62412d647bc5ae25453024dea54
SHA256

1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528
SHA512

33abe57e4c30f8b592ee0ece9aadf829795435bed7f7f6497a1dc45e351f24b6ec8098281e08a8d989e55b3cf71192e1a5b33896192bdd936bddbab9d2d4aa11
SSDEEP

49152:Qoa1taC070dptJud1xgcKcnlGVMcDGA8X0oa7rDrt3R:Qoa1taC0xTgugMcnnowtB

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2548	7D0F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2548	7D0F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D0F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2548	4764	1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe	83
PID 4764 wrote to memory of 2548	4764	1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe	83
PID 4764 wrote to memory of 2548	4764	1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe	83

C:\Users\Admin\AppData\Local\Temp\1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\7D0F.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D0F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1c5a4b17bcbd1dd0c942c977bf72de335298562926699e376b48180e672a3528.exe F2BD7A7B9D838776A81B781265688BBE7873537F646D3104EDE5E9E4D31BF6BC96CCC9C83BD5A256B96E06944758F4CBAB88D108B3757D7525E78E00E1A59BF2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7D0F.tmp

Filesize
1.9MB

MD5
bc22c9c1d2e1f617a7cc2257fe5baa0b

SHA1
edc95513c09c62d10437d47f9a4c160e19e83ae2

SHA256
a5a6636cccec09e6b9c401a0470b13ae86cd0d6d4929b64341f5d78b461d292f

SHA512
b938875fcecdaf8a939e5aef5a47d05dcad9ffcf5bd9e95003a3126b106dbee8ab5f4a1e3fcd7a6cbc673ca65d5245dbd7a7a6235418bb1a54b1c59e6bde65f2

Download Submit
memory/2548-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4764-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download