9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ec

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe
Size

1.8MB
MD5

f88b7b4c7cfc9ad7f5d85ff74549bfb0
SHA1

ddffef3d2d8c7e3699eec5219a2cd46f4f7a6931
SHA256

9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ec
SHA512

5e9dfcc8fa7d978fb796712ee0134dced3f35cb94e7d28165f60ab701bae7f0a7e6736f53e4b408ddd7687742a05ff840ee60f6f84a3e1df1b59d5508a633fc3
SSDEEP

24576:HawwKusHwEwSDMn6NGqKBHLidUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71t:XwREDDMZHGdHeMxWrP+beY7UY71t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4788	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp

Loads dropped DLL 1 IoCs

pid	Process
4788	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4788	4244	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe	83
PID 4244 wrote to memory of 4788	4244	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe	83
PID 4244 wrote to memory of 4788	4244	9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe	83

C:\Users\Admin\AppData\Local\Temp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe
"C:\Users\Admin\AppData\Local\Temp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\is-UA2II.tmp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UA2II.tmp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp" /SL5="$80092,935482,845824,C:\Users\Admin\AppData\Local\Temp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-SAEJF.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UA2II.tmp\9f6ff2baaaa1b01c26d7ab06667e2824140fadd2cb9dae2b6da9803c071501ecN.tmp

Filesize
3.2MB

MD5
52a53b6e6d1071b7da329a4989c0f132

SHA1
dc3085f2881f72dfee79fb5029eb3599d1c2fbf6

SHA256
dd3ea1c4bf44720555a10f6df36e03da988d94aa848c23c8b0cbd4f61209fec3

SHA512
4d9f0c705f4db461068a12d5cd6208af56163fbc6c995bb9c2455ce631d71294f4b1d04fb31d9166bfef8c0afe154bdc27a01d446f38187799f7a9a513d79196

Download Submit
memory/4244-12-0x00000000001D0000-0x00000000002AC000-memory.dmp

Filesize
880KB

Download
memory/4244-2-0x00000000001D1000-0x0000000000279000-memory.dmp

Filesize
672KB

Download
memory/4244-0-0x00000000001D0000-0x00000000002AC000-memory.dmp

Filesize
880KB

Download
memory/4788-16-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-14-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4788-13-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-6-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4788-18-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-20-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-22-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-24-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-26-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-28-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-30-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-32-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download
memory/4788-34-0x0000000001000000-0x0000000001343000-memory.dmp

Filesize
3.3MB

Download