24a6937972322f9010713e46770c092835a064a4185a7ea6444054fde57e6c10

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
Size

423KB
MD5

f4367b0139952a0f2cf8a669484f35b9
SHA1

d5a34c1fe6fa4ae0d9430de94514b150041df431
SHA256

2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67
SHA512

330dcbd55d7fa54aec5ab99cd559d414db585bfccd5dcb9a307796d6541ce781e369423042b8d6f2f8c7059a265a78f75f42748e40aa73aa438ffa762bd80449
SSDEEP

6144:9wVQx8ayrbor77JaQOCzixo3wFnK0+pDp2WyULR5z/ug:JxPgUrAQOE02h1bTzWg

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5020	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	5020	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4080	5020	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	82
PID 5020 wrote to memory of 4080	5020	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	82
PID 5020 wrote to memory of 4080	5020	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	82

C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
"C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
  "C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe"
  2⤵
  PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 916
  2⤵
  - Program crash
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5020 -ip 5020
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nskACCC.tmp\hvlovmp.dll

Filesize
4KB

MD5
326a702abb396435221880fd71450249

SHA1
62f5a8e24469859250a5630e5b9280b8472e5a56

SHA256
f936817179febc934e8fa271aac522f989e6a6b43ebf42a44588f71ecae79042

SHA512
3018fa492ecbba49350db3f93df5f20852a47dd363315704737b2abd9c70bf86cc74858572a267e7fb79f8590c064ebaa0024ac84b41fb7fb684a3c23f7da615

Download Submit
memory/5020-10-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download