857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
Size

6.8MB
MD5

9cf2fcabd10ee683a3652815014b368c
SHA1

f49914f1cf2b7fbba812eb8fd807b19065008b23
SHA256

857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623
SHA512

8dcf40e92d40627fb79413c6662e43e87d1dcd23e2825aa87a96e09706cff25e5e894376fdf5570d0e8470c36a4574810fc8afea3c720595fac07b93d0904117
SSDEEP

196608:e741InG5lNniIbZg4TYc1vR31A4zur5MOjjDDTTVCjE/gsOt0G1:e741ZbPH1AJCY/Ur

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2284	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30
PID 2084 wrote to memory of 2284	2084	857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe	30

C:\Users\Admin\AppData\Local\Temp\857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
"C:\Users\Admin\AppData\Local\Temp\857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe
  "C:\Users\Admin\AppData\Local\Temp\857270428d9d88c5da6d8b9d33059d4e29347637879a17975631408c5359b623.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20842\python39.dll

Filesize
4.3MB

MD5
5bafe23107e6df19de8f7ac9068ed26e

SHA1
d2a88beaf959bd5331948b03330c98fe8fa85c7c

SHA256
c1e5a847ae6aa9d9f42b482c7a20dcdc9dfe225f7186b0b01924225aa4e5e581

SHA512
1c2372debc0e2e53ea281798f15243294430e4e7e4d3b82e4ab998a1b7c77cad68d50e196e37c6ff7ba83b08a12286af5d2797bfa707af5dad180862cce7efc7

Download Submit