9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66

General

Target

9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe
Size

1.8MB
MD5

eac199009ccae26cda80ed8a87ee400e
SHA1

1108527ef381dcf398a9e6ab233fa24d763305a7
SHA256

9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66
SHA512

b6955af8d8f48a14803b0c9a0e96ca478e4d26766c9ccc934809463bc90eced57bf991cb91527ff4b7a5bcd49927901e0748604061da536c3aae504d3f9430ea
SSDEEP

24576:HawwKusHwEwSDMn64GqKWMidUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71F:XwREDDMo4bdHeMxWrP+beY7UY71F

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp

Loads dropped DLL 2 IoCs

pid	Process
2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe
2088	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31
PID 2416 wrote to memory of 2088	2416	9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe	31

C:\Users\Admin\AppData\Local\Temp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe
"C:\Users\Admin\AppData\Local\Temp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\is-N4URN.tmp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N4URN.tmp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp" /SL5="$5014E,935482,845824,C:\Users\Admin\AppData\Local\Temp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-N4URN.tmp\9a9370c49a2ae697f02f83d91d534dba997ada30b561bfc124d09b3985a8fc66.tmp

Filesize
3.2MB

MD5
a0116ac084b2bfc89b4dfef339cf3f5d

SHA1
9494124024f38d0d9ffb0149d21b280e3e32eaf0

SHA256
567ed940a398e3c6790b44dfc3a6861fea2351e962327ca91e50ec20f4495004

SHA512
8a397292913ef39baad3315e934f2a8b6117ef8344d8117a34b6c0caf76e7eaff2326466d631fd4b34c46f19015a7632c885d14856013d1e878067389a104eb6

Download Submit
\Users\Admin\AppData\Local\Temp\is-REHV7.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/2088-18-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-20-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-36-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-34-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-16-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2088-15-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-32-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-8-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2088-22-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-24-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-26-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-28-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2088-30-0x0000000000BF0000-0x0000000000F33000-memory.dmp

Filesize
3.3MB

Download
memory/2416-0-0x0000000000A50000-0x0000000000B2C000-memory.dmp

Filesize
880KB

Download
memory/2416-14-0x0000000000A50000-0x0000000000B2C000-memory.dmp

Filesize
880KB

Download
memory/2416-2-0x0000000000A51000-0x0000000000AF9000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing