b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42

General

Target

b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
Size

1.8MB
MD5

e1b1b4e8f48045cf18376eccaf81f897
SHA1

8ebf25c2ddfaf7ea17c1be5ba7d40793fa399d58
SHA256

b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42
SHA512

d7b23d23fe2a935bf7f4d5440e6a2cd7e39857b3423d67b1cfcb22563ee17cc7058f252eb015c2b23ff04df7c9443d3ab04432d8977eb86c40d558ca7d0cb928
SSDEEP

49152:eTUit2C759KwH8t4m6tPXuXt14qNZbzvgI5ogEyXlM:eTUiD75ns4m6qt14qjkIJ3Xy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2872	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	31
PID 1628 wrote to memory of 2872	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	31
PID 1628 wrote to memory of 2872	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	31
PID 1628 wrote to memory of 2872	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	31
PID 1628 wrote to memory of 2800	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	32
PID 1628 wrote to memory of 2800	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	32
PID 1628 wrote to memory of 2800	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	32
PID 1628 wrote to memory of 2800	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	32
PID 1628 wrote to memory of 2760	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	33
PID 1628 wrote to memory of 2760	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	33
PID 1628 wrote to memory of 2760	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	33
PID 1628 wrote to memory of 2760	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	33
PID 1628 wrote to memory of 2708	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	34
PID 1628 wrote to memory of 2708	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	34
PID 1628 wrote to memory of 2708	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	34
PID 1628 wrote to memory of 2708	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	34
PID 1628 wrote to memory of 2728	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	35
PID 1628 wrote to memory of 2728	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	35
PID 1628 wrote to memory of 2728	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	35
PID 1628 wrote to memory of 2728	1628	b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe	35

C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
"C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
  "C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
  "C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
  "C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
  "C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe
  "C:\Users\Admin\AppData\Local\Temp\b5fec209a03ef46ff5851c223137b439c1bcfdc1d22a0c8d7bf3bc8921e4ab42.exe"
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/1628-1-0x0000000000050000-0x000000000022E000-memory.dmp

Filesize
1.9MB

Download
memory/1628-2-0x00000000007D0000-0x00000000007DE000-memory.dmp

Filesize
56KB

Download
memory/1628-3-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1628-4-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/1628-5-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1628-6-0x0000000007F10000-0x00000000080AA000-memory.dmp

Filesize
1.6MB

Download
memory/1628-7-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing