f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe
Size

14KB
MD5

96f604711c6a6ef41bce51fa62a59550
SHA1

9f80375ffb28145afa208476699eb03fcd419d6f
SHA256

f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817
SHA512

df3fc03d19353b8127bff52fddedd21e2c8cb064d38d6a8a01ec55f17b6a97b702971ac22514f3d2acf683a3985d3c964abaab8dee660803465c65948828aadb
SSDEEP

192:HsBPEKR1JfsU02Joj8fwDeaY7UYYJ213grR+R8rxJdq/hIRub:HGmxaKDPY7YAJax/ohIRM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 316	2900	f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe	29
PID 2900 wrote to memory of 316	2900	f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe	29
PID 2900 wrote to memory of 316	2900	f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe	29
PID 2900 wrote to memory of 316	2900	f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe	29

C:\Users\Admin\AppData\Local\Temp\f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe
"C:\Users\Admin\AppData\Local\Temp\f46e87658dc2b283556ab0ea6fd20686987df14e7db54823c5ac37ad7c91a817N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c malware.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-2-0x0000000001260000-0x000000000126B000-memory.dmp

Filesize
44KB

Download