d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046

Analysis

max time kernel
94s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
Size

160KB
MD5

50372b8bc598758fd5d85102172a3735
SHA1

3be32de76798e152dd199984c6941055f544f411
SHA256

d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046
SHA512

e825b2d28940bc5a0a95b8ea9c4a0c12a8611fd014199ccf31d74c35b66f185160a313e7c1f3707afaeaaadc87efde3922b101365a353b14a73af1f850f96bec
SSDEEP

3072:jik8/Lfyzvm6Rf6Omn/0sX096MGUlR4WjK:G/LqzBwzcsXXMDBu

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3136	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
3136	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 2112 wrote to memory of 3136	2112	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	85
PID 3136 wrote to memory of 2952	3136	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	86
PID 3136 wrote to memory of 2952	3136	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	86
PID 3136 wrote to memory of 2952	3136	d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe	86

C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
"C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe
  "C:\Users\Admin\AppData\Local\Temp\d2c04ff8a301233ce5febcbde3c5242dc1093b3d9e4f2597c4632ca848a9a046.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-3-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Filesize
56KB

Download
memory/3136-2-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3136-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download