Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 03:41

General

  • Target

    cl.exe

  • Size

    236KB

  • MD5

    748ec019c171f22b8384195742967c51

  • SHA1

    e3fefcbd3c432ac85d046a7ab27d2b0114ae658a

  • SHA256

    b082e82311a6e8416b1823122959ea368316a936aa6ca667c032d300f76effaf

  • SHA512

    a2bbef3dacdac5d5cf65f71f97c663b8731e2f2dbd9d923076e3551b68fce33157b961bd4709bfd6ccb1c5c807c453a8bae209538093dfe4c0662fb7e074ddc3

  • SSDEEP

    6144:6741oQa1cxp/UWD9xgYxY68hX7Ph0ht7LRhU/a:v1uOp8J2Y68hLPhZ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cl.exe
    "C:\Users\Admin\AppData\Local\Temp\cl.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Roaming\WinCL\wincl.exe
      "C:\Users\Admin\AppData\Roaming\WinCL\wincl.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3216
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\1.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\1.bat

    Filesize

    167B

    MD5

    43cc03e4b5ddb283fa10abfc8d09e5a7

    SHA1

    acb4ac7841a8fd9f1ec0321d47ece0217198d6c7

    SHA256

    24bb870ceb6fdcaffea19dcc11bc0b08b79115ee14478f54fd72ffde75b37033

    SHA512

    dee8f946d12655a9eef3226a8e1d3ff0eff4e8e96d0cf6c1fdc08e140f1e04f87c610979cc729de6aeac9bd667f08faf06a46308eb0bb3b40b74d271315d23e0

  • C:\Users\Admin\AppData\Roaming\WinCL\tmp.dat

    Filesize

    201KB

    MD5

    942f00f8f5f734d0c6faf1ab3526f704

    SHA1

    005a906c00aa214ebbc778bfe629691ce7cace9d

    SHA256

    86e3cf50b25c7c8911343a1aad812f00829fadca78b567099202548e953e0b4f

    SHA512

    f64f1ac07e431b0e7ba633367b95f8a25a3e9cead2d0128f8b093579daad95d58dd9b14e0d370d0ec72cae81bb70e2396cf2dde6765e9b3379a4a783c8f82631

  • C:\Users\Admin\AppData\Roaming\WinCL\wincl.exe

    Filesize

    236KB

    MD5

    748ec019c171f22b8384195742967c51

    SHA1

    e3fefcbd3c432ac85d046a7ab27d2b0114ae658a

    SHA256

    b082e82311a6e8416b1823122959ea368316a936aa6ca667c032d300f76effaf

    SHA512

    a2bbef3dacdac5d5cf65f71f97c663b8731e2f2dbd9d923076e3551b68fce33157b961bd4709bfd6ccb1c5c807c453a8bae209538093dfe4c0662fb7e074ddc3