2882cbed0fb11c95d01b487a85338f4ec25fd44fc3f0936d68af4832d1be9a54

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransom/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

builder.exebuilder.exebuilder.exebuilder.exebuilder.exebuilder.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

Processes:

keygen.exebuilder.exebuilder.exebuilder.exebuilder.exebuilder.exebuilder.exe

pid	Process
2484	keygen.exe
2876	builder.exe
2948	builder.exe
2960	builder.exe
3000	builder.exe
2888	builder.exe
2992	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 2484	2376	cmd.exe	30
PID 2376 wrote to memory of 2484	2376	cmd.exe	30
PID 2376 wrote to memory of 2484	2376	cmd.exe	30
PID 2376 wrote to memory of 2484	2376	cmd.exe	30
PID 2376 wrote to memory of 2876	2376	cmd.exe	31
PID 2376 wrote to memory of 2876	2376	cmd.exe	31
PID 2376 wrote to memory of 2876	2376	cmd.exe	31
PID 2376 wrote to memory of 2876	2376	cmd.exe	31
PID 2376 wrote to memory of 2948	2376	cmd.exe	32
PID 2376 wrote to memory of 2948	2376	cmd.exe	32
PID 2376 wrote to memory of 2948	2376	cmd.exe	32
PID 2376 wrote to memory of 2948	2376	cmd.exe	32
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 2960	2376	cmd.exe	33
PID 2376 wrote to memory of 3000	2376	cmd.exe	34
PID 2376 wrote to memory of 3000	2376	cmd.exe	34
PID 2376 wrote to memory of 3000	2376	cmd.exe	34
PID 2376 wrote to memory of 3000	2376	cmd.exe	34
PID 2376 wrote to memory of 2888	2376	cmd.exe	35
PID 2376 wrote to memory of 2888	2376	cmd.exe	35
PID 2376 wrote to memory of 2888	2376	cmd.exe	35
PID 2376 wrote to memory of 2888	2376	cmd.exe	35
PID 2376 wrote to memory of 2992	2376	cmd.exe	36
PID 2376 wrote to memory of 2992	2376	cmd.exe	36
PID 2376 wrote to memory of 2992	2376	cmd.exe	36
PID 2376 wrote to memory of 2992	2376	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ransom\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\ransom\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\ransom\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3Decryptor.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_pass.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_Rundll32.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_Rundll32_pass.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ransom\Build\priv.key

Filesize
344B

MD5
7394c82605c05303014951ffd2a09c56

SHA1
c97c1a435a6498d9c22a6e55551b2e6843645c5f

SHA256
657399280a211394f0e7789680b88e428a999458fb8d29494648fe1805ad198d

SHA512
0364817ded401c16e193c6c72b1d73e2e1e07aac300b009b895109f4fb988958818d6949a18e9a697385624b8b7f21e953b73559e85ca1b8258eac5784f3bc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key

Filesize
344B

MD5
0a890fa1564a45b37d9580836d476469

SHA1
11ad6073ea0804e628603cb65d5b60d7ab3820ec

SHA256
c5f3810ec58ea47aca34c246ced34ff0b70dbd87dc86c0dde081981b9e8ba47c

SHA512
fb831654bcd3bf3d066c075184d73e652973098aae741da561e10b57ad8de704ba97059f50e4c599fd9366bf527aa820ccb3044d1a0fda09e963be86911fa3ad

Download Submit