028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe
Size

6.8MB
MD5

1565ba0f3f4b6f5500a3129845d24d73
SHA1

bf80be95d12efbd41548e395474151b7379949b0
SHA256

028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670
SHA512

2ddba128bbf923e05f32fa0cc16bab1276eb110224b1b52167f9eb53e424b2ab3db53b73cbcce443532a87ee8a280ca67d98001c0cb6ac1cb714863746db9d57
SSDEEP

196608:e741InG5lNniIbZg4TYc1vR31A4zur5MOjjDDTTVCjE/gsOt0G1O:e741ZbPH1AJCY/Urc

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2880	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31
PID 2308 wrote to memory of 2880	2308	028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe	31

C:\Users\Admin\AppData\Local\Temp\028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe
"C:\Users\Admin\AppData\Local\Temp\028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe
  "C:\Users\Admin\AppData\Local\Temp\028717d235b61c6ede892437f09d0cceaa5345268f787c00b58f27a082975670.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23082\python39.dll

Filesize
4.3MB

MD5
5bafe23107e6df19de8f7ac9068ed26e

SHA1
d2a88beaf959bd5331948b03330c98fe8fa85c7c

SHA256
c1e5a847ae6aa9d9f42b482c7a20dcdc9dfe225f7186b0b01924225aa4e5e581

SHA512
1c2372debc0e2e53ea281798f15243294430e4e7e4d3b82e4ab998a1b7c77cad68d50e196e37c6ff7ba83b08a12286af5d2797bfa707af5dad180862cce7efc7

Download Submit