Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 10:10
Static task
static1
Behavioral task
behavioral1
Sample
Awb4586109146.bat.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Awb4586109146.bat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Awb4586109146.bat.exe
-
Size
776KB
-
MD5
a3bb238f798a512f7465f804735b8f9a
-
SHA1
31c7c96a95c22e7f4ab58b0f5330c4c79172be79
-
SHA256
9775ae8b4fa626011fb022ede69e2ec2bec2b7868bb70bda276da0145b4b410f
-
SHA512
4038f9e8b93e6e4dfa4f4b7493bb2e5988ee29a2d91029fa136549f424140cf0a77426d8739d40e95c5ac943681b384bdeb966d84bce0693c24d578220c1365e
-
SSDEEP
24576:4dEqcVwnUAFPtUBCSoR94Ou2sgnqVNO7qg+E5cnj:HqcVwnhFPtU7oR3uIn6NAqDE5cnj
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 1736 Awb4586109146.bat.exe 1736 Awb4586109146.bat.exe 1736 Awb4586109146.bat.exe 1736 Awb4586109146.bat.exe 1736 Awb4586109146.bat.exe 1736 Awb4586109146.bat.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\tripennate\Funktionrgruppes19.has Awb4586109146.bat.exe File opened for modification C:\Windows\locale\Indviklingerne.ini Awb4586109146.bat.exe File opened for modification C:\Windows\resources\havarierne\firmamrke.kna Awb4586109146.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 304 1736 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Awb4586109146.bat.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 304 1736 Awb4586109146.bat.exe 31 PID 1736 wrote to memory of 304 1736 Awb4586109146.bat.exe 31 PID 1736 wrote to memory of 304 1736 Awb4586109146.bat.exe 31 PID 1736 wrote to memory of 304 1736 Awb4586109146.bat.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Awb4586109146.bat.exe"C:\Users\Admin\AppData\Local\Temp\Awb4586109146.bat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 5242⤵
- Program crash
PID:304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
5KB
MD5ab1db56369412fe8476fefffd11e4cc0
SHA1daad036a83b2ee2fa86d840a34a341100552e723
SHA2566f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
SHA5128d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d