62cdff077aa0bd67d1b52e1d5e5b5aa34ec9e74dd2d2440f6b02d2f73a249b6e

Analysis

max time kernel
36s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
22-12-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Client.exe
Size

164KB
MD5

c0176890b7a76bc4b4361994288794ec
SHA1

fad41ab4f12c10d01609f3d9c821baeab407304f
SHA256

62cdff077aa0bd67d1b52e1d5e5b5aa34ec9e74dd2d2440f6b02d2f73a249b6e
SHA512

82509544d7637b7d87ca04e3335bd36816683e17f34787523556b2c35816770f36f5166fa022565f37b1b0c1898031266bf618f0fdec92fabbe5efa240e919e3
SSDEEP

3072:j6GN/4ZmTcci+ui9vhggOYyKqvO5ctEs+SNwCUbEM09a8U:j6f+ui9vq4qvAsNNObTO

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
1	6.tcp.eu.ngrok.io

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
400	cmd.exe
5044	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5044	PING.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	New Client.exe
Token: 33	3044	New Client.exe
Token: SeIncBasePriorityPrivilege	3044	New Client.exe
Token: 33	3044	New Client.exe
Token: SeIncBasePriorityPrivilege	3044	New Client.exe
Token: 33	3044	New Client.exe
Token: SeIncBasePriorityPrivilege	3044	New Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3324	3044	New Client.exe	79
PID 3044 wrote to memory of 3324	3044	New Client.exe	79
PID 3044 wrote to memory of 3324	3044	New Client.exe	79
PID 3044 wrote to memory of 2864	3044	New Client.exe	81
PID 3044 wrote to memory of 2864	3044	New Client.exe	81
PID 3044 wrote to memory of 2864	3044	New Client.exe	81
PID 3044 wrote to memory of 400	3044	New Client.exe	83
PID 3044 wrote to memory of 400	3044	New Client.exe	83
PID 3044 wrote to memory of 400	3044	New Client.exe	83
PID 400 wrote to memory of 5044	400	cmd.exe	85
PID 400 wrote to memory of 5044	400	cmd.exe	85
PID 400 wrote to memory of 5044	400	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\New Client.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\PING.EXE
    ping 0 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000074D81000-0x0000000074D82000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-2-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-3-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-4-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-5-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-6-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download
memory/3044-8-0x0000000074D80000-0x0000000075331000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads