01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe
Size

350KB
MD5

0e1092371876b363945a914731d9ab70
SHA1

3d9fc87f11fb3b44e469886e03c8b210e05e3ef4
SHA256

01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541
SHA512

5c0dd2b734ae26f89300047cfe148d98e24ece0b00adfb8b17f20e05ff06ea275714acac670ead13ebd0afbfa1a5622bc69580c6fc984c6f7f52d102c2c1bbd8
SSDEEP

6144:loGhpuBMG29Gt6I/pPo486MAwA3l1AiE56:lppu6G29Gt62PoKRl1456

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
680	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541Nmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000023b77-3.dat	upx
behavioral2/memory/680-4-0x0000000000400000-0x000000000046E000-memory.dmp	upx
behavioral2/memory/680-9-0x0000000000400000-0x000000000046E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3436	680	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541Nmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 680	4016	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe	82
PID 4016 wrote to memory of 680	4016	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe	82
PID 4016 wrote to memory of 680	4016	01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe	82

C:\Users\Admin\AppData\Local\Temp\01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe
"C:\Users\Admin\AppData\Local\Temp\01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541Nmgr.exe
  C:\Users\Admin\AppData\Local\Temp\01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541Nmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 264
    3⤵
    - Program crash
    PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 680 -ip 680
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\01a488fab72eb83b57323b7aeeb8a7989a20975bb7cc035f8d84dd14ac349541Nmgr.exe

Filesize
201KB

MD5
30fb1fab26c96c5c6a94718688a8afbb

SHA1
bad03303e55d34ddd113a4f7e40959c3762891d3

SHA256
d6d96beed3a218938fb65ba9ae32634334eb8a1ca47243aad4027c712741cc3c

SHA512
75e67329f3643dbc6106d227469ab5f2ebe072782c2a0a17328d37f549136410d54e3bab650f00741075a54eee6d6079a627f69f5921e4b658cc4e6f76b95e61

Download Submit
memory/680-4-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/680-7-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/680-9-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4016-0-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download
memory/4016-6-0x00000000000C0000-0x000000000011C000-memory.dmp

Filesize
368KB

Download