2882cbed0fb11c95d01b487a85338f4ec25fd44fc3f0936d68af4832d1be9a54

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransom/Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

builder.exebuilder.exebuilder.exebuilder.exebuilder.exekeygen.exebuilder.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exe

description	pid	Process	procid_target
PID 3460 wrote to memory of 2312	3460	cmd.exe	83
PID 3460 wrote to memory of 2312	3460	cmd.exe	83
PID 3460 wrote to memory of 2312	3460	cmd.exe	83
PID 3460 wrote to memory of 3332	3460	cmd.exe	84
PID 3460 wrote to memory of 3332	3460	cmd.exe	84
PID 3460 wrote to memory of 3332	3460	cmd.exe	84
PID 3460 wrote to memory of 2564	3460	cmd.exe	85
PID 3460 wrote to memory of 2564	3460	cmd.exe	85
PID 3460 wrote to memory of 2564	3460	cmd.exe	85
PID 3460 wrote to memory of 4488	3460	cmd.exe	86
PID 3460 wrote to memory of 4488	3460	cmd.exe	86
PID 3460 wrote to memory of 4488	3460	cmd.exe	86
PID 3460 wrote to memory of 4424	3460	cmd.exe	87
PID 3460 wrote to memory of 4424	3460	cmd.exe	87
PID 3460 wrote to memory of 4424	3460	cmd.exe	87
PID 3460 wrote to memory of 3608	3460	cmd.exe	88
PID 3460 wrote to memory of 3608	3460	cmd.exe	88
PID 3460 wrote to memory of 3608	3460	cmd.exe	88
PID 3460 wrote to memory of 4596	3460	cmd.exe	89
PID 3460 wrote to memory of 4596	3460	cmd.exe	89
PID 3460 wrote to memory of 4596	3460	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ransom\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\ransom\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\ransom\Build -pubkey pub.key -privkey priv.key
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3Decryptor.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_pass.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_Rundll32.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_Rundll32_pass.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\ransom\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\ransom\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ransom\Build\priv.key

Filesize
344B

MD5
836cbc1c4dad9ffd4abdb27ed98d57f7

SHA1
b84dfb08cc0a70e34360bf518ca3be002dabe8cb

SHA256
679e662ae76cf37058561fe2b5353b7eb1a0156ea26542630aeafba5740a6415

SHA512
54334d7a604942b86961ddb3c93081211f4f870607019e84b185d0a15359e0f7f6271db5045cdd9466c6737042a61c5b1727fae12a6aad447a955f9c5f9316cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ransom\Build\pub.key

Filesize
344B

MD5
dd4d23840e3a9fc3f8dfad3051bbe60f

SHA1
41135caa32932400b6475f840a3c79eac1ce433e

SHA256
3c551ac76f0dc38546d1045d3afbd4ebca5d82d452ff1160741459d76d0248b6

SHA512
b3f71b68c41968cf4ccab106a6e4c7346086ed140234bedbfb9355e3c8d36328f3786cf74f7833019e401032931ecb40a6b0ab9ae93878d1ca98f1bcf3760ab6

Download Submit