2e409cae7c78d6e62bb7821771b1ff25cbd098a2f2c4fadbe68bab5ebea4d773

Analysis

max time kernel
138s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1naryn1nja_personal_win64.exe
Size

407.6MB
MD5

5e64d09c63eb5b569629e512f81f472f
SHA1

b64f84fd12fcb61cd2bc78f7dedd71d9038d6b97
SHA256

2e409cae7c78d6e62bb7821771b1ff25cbd098a2f2c4fadbe68bab5ebea4d773
SHA512

ffddc83a465bb02ce37322c2b3a58acdee34306c5423c3423f0356386197be3f3f298a4652c03dddf43e2e1a1e665f77d6f2c42bbc5008a722af6f32a16b5156
SSDEEP

12582912:CBSm1FubqfoRO1JLYqO3TI4FJGV0510xR7JcCh+/FkITcYbQkm:SFCRO1JUqO3TI4bGVu10xR9dI/dfU

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4992	b1naryn1nja_personal_win64.exe
4992	b1naryn1nja_personal_win64.exe
4992	b1naryn1nja_personal_win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1naryn1nja_personal_win64.exe

C:\Users\Admin\AppData\Local\Temp\b1naryn1nja_personal_win64.exe
"C:\Users\Admin\AppData\Local\Temp\b1naryn1nja_personal_win64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd5A.tmp\System.dll

Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd5A.tmp\UserInfo.dll

Filesize
4KB

MD5
e167f9a565781a30c03ff10370033319

SHA1
1858758b076946073de375c6eb1bec9867aa3689

SHA256
a912514823df595ba3a048099d3b89e925a4d41742afc67e772060952892f312

SHA512
96d8f5ac8e2c0961ba71075de52d12515e7a058cddf3fa1ec14e77545b0b5f4e29324a13e2eb287a447f1d24dc9f09e0a70b0a25401b0ef8d90e6e4a96ce6c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd5A.tmp\nsDialogs.dll

Filesize
9KB

MD5
6e64e5d5f9498058a300b26b8741d9d5

SHA1
837ce28e5e02788da63a7f1d8f20207d2b0bf523

SHA256
8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33

SHA512
f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e

Download Submit