a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d

Analysis

max time kernel
38s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe
Size

116KB
MD5

7288e3833d6dc6c0f0e685984c3cd68e
SHA1

b3ca51e56bfa03e327944c7df7045c0800c2928b
SHA256

a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d
SHA512

0eac1410b85a07666be3aa836cc81271e06952128cd5b9d34b93e168f1b5047470cf7056abc4b66cc339f7ee7a4da6259c5e15683837477226398ef363b2660d
SSDEEP

1536:JOH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5PxVG:JCKQJcinxphkG5Q6GdpIOkJHhKRfG

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/228136-712884-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/228136-712927-0x0000000000400000-0x000000000040B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe

C:\Users\Admin\AppData\Local\Temp\a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe
"C:\Users\Admin\AppData\Local\Temp\a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2596
- C:\Users\Admin\AppData\Local\Temp\a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe
  "C:\Users\Admin\AppData\Local\Temp\a9c9bc3aa046023d24aee0c49042a5de667dc89e51a4263a1590fb2a6f889d5d.exe"
  2⤵
  PID:228136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\XLQVB.bat" "
    3⤵
    PID:176200
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
      4⤵
      PID:69304
- - C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
    "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
    3⤵
    PID:228364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XLQVB.bat

Filesize
145B

MD5
da0cbe87b720a79b294147ed6a4b98be

SHA1
ebf0dc9efd7a12cb192e355cda87546acb4ab360

SHA256
7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

SHA512
f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

Download Submit
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe

Filesize
116KB

MD5
88faa9f6a92a32315788e50d53e83fb5

SHA1
814c17a1603c14e4bafa2bd78151c9dc760672ed

SHA256
a3d80cb6da1d12824a027da1a782ee982ccd8e4769d3fe5aa626dbf0e81972f0

SHA512
7d0fb3f1f4679b3fc3892f9372bb4983f07690a604eb8dd22fb77569ec85949399f88553e53cf1fd4b7c662f80b9dfb11720661634d50da9e36d603d89f30886

Download Submit
memory/2596-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2596-10-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2596-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2596-50-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2596-40-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/2596-20-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/228136-712884-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/228136-712927-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download