Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 10:10

General

  • Target

    Awb4586109146.bat.exe

  • Size

    776KB

  • MD5

    a3bb238f798a512f7465f804735b8f9a

  • SHA1

    31c7c96a95c22e7f4ab58b0f5330c4c79172be79

  • SHA256

    9775ae8b4fa626011fb022ede69e2ec2bec2b7868bb70bda276da0145b4b410f

  • SHA512

    4038f9e8b93e6e4dfa4f4b7493bb2e5988ee29a2d91029fa136549f424140cf0a77426d8739d40e95c5ac943681b384bdeb966d84bce0693c24d578220c1365e

  • SSDEEP

    24576:4dEqcVwnUAFPtUBCSoR94Ou2sgnqVNO7qg+E5cnj:HqcVwnhFPtU7oR3uIn6NAqDE5cnj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Awb4586109146.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\Awb4586109146.bat.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 524
      2⤵
      • Program crash
      PID:304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsoCE77.tmp\System.dll

    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • \Users\Admin\AppData\Local\Temp\nsoCE77.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    ab1db56369412fe8476fefffd11e4cc0

    SHA1

    daad036a83b2ee2fa86d840a34a341100552e723

    SHA256

    6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b

    SHA512

    8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.