a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe
Size

350KB
MD5

cb52f91ffac79a97d500f93f022d7771
SHA1

d38edb35c09cd7fa56c6cb1c27329254954ede7e
SHA256

a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b
SHA512

b68d010cd55bc760cfe5108d66620621a6c65175c0f44ed7730cd9bb3fe35e8f740bbf2c73bdf929114e72f66102380c82a254cceaabdb63c9d1d8f1177c383f
SSDEEP

6144:loGhpuBMG29Gt6I/pPo486MAwA3l1AiE5a:lppu6G29Gt62PoKRl145a

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1200	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113bmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b33-4.dat	upx
behavioral2/memory/1200-6-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/1200-8-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	1200	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113bmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1200	220	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe	84
PID 220 wrote to memory of 1200	220	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe	84
PID 220 wrote to memory of 1200	220	a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe	84

C:\Users\Admin\AppData\Local\Temp\a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe
"C:\Users\Admin\AppData\Local\Temp\a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113bmgr.exe
  C:\Users\Admin\AppData\Local\Temp\a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113bmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 264
    3⤵
    - Program crash
    PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a25ca3d15e1ba4dc93cc8c403725a5b1ca4f1fef763ca3cdd2d6f382e592113bmgr.exe

Filesize
201KB

MD5
30fb1fab26c96c5c6a94718688a8afbb

SHA1
bad03303e55d34ddd113a4f7e40959c3762891d3

SHA256
d6d96beed3a218938fb65ba9ae32634334eb8a1ca47243aad4027c712741cc3c

SHA512
75e67329f3643dbc6106d227469ab5f2ebe072782c2a0a17328d37f549136410d54e3bab650f00741075a54eee6d6079a627f69f5921e4b658cc4e6f76b95e61

Download Submit
memory/220-0-0x0000000000AD0000-0x0000000000B2C000-memory.dmp

Filesize
368KB

Download
memory/220-5-0x0000000000AD0000-0x0000000000B2C000-memory.dmp

Filesize
368KB

Download
memory/1200-7-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/1200-6-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1200-8-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download