Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 16:23

General

  • Target

    8a0a6bad685a0e4517d2f1e8f70fff1195c78470e467255dfeb1c3f7ec922514.exe

  • Size

    970KB

  • MD5

    492707a5e753b9c5faa6a9829e065775

  • SHA1

    7a48c9ae447780551a9714b5cccde57f16094e01

  • SHA256

    8a0a6bad685a0e4517d2f1e8f70fff1195c78470e467255dfeb1c3f7ec922514

  • SHA512

    e7ab1808dadb1a1da12ac66e6f9c631a5ca58b4575bebfba21aa6b6907153bd8e4af2904e3039a77f0a4f9bc94cd408f108c05181878270c5446862b01ffa707

  • SSDEEP

    24576:oewAoAZIk1OYV8pC0SUGKSGnx7eq0xQUsHVSm:CAFLErOUGKSe5eq0xQhHs

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a0a6bad685a0e4517d2f1e8f70fff1195c78470e467255dfeb1c3f7ec922514.exe
    "C:\Users\Admin\AppData\Local\Temp\8a0a6bad685a0e4517d2f1e8f70fff1195c78470e467255dfeb1c3f7ec922514.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 484
      2⤵
      • Program crash
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsyA017.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    3dd80dff583544514eeb3a5ed851a519

    SHA1

    56f7324d9d4230c96d1963e7b3e02b05a6cf5c24

    SHA256

    86cff5eaca76c49f924cb123d242fdcfd45ab99c4b638d3b8f4a8cfb1970ab5b

    SHA512

    955f4df195b5d134449904e9020f80125cfb64d70d9482ff583451f3fcb10d15577ceac4180f71a96452d8478f6365160ab15731f9a79a494383087c9310fd1d

  • \Users\Admin\AppData\Local\Temp\nsyA017.tmp\System.dll

    Filesize

    11KB

    MD5

    75ed96254fbf894e42058062b4b4f0d1

    SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

    SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • memory/2396-33-0x0000000003E20000-0x000000000500D000-memory.dmp

    Filesize

    17.9MB

  • memory/2396-34-0x0000000003E20000-0x000000000500D000-memory.dmp

    Filesize

    17.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.