d4d0077e12c1b749c38b0cedf2de547b49aaf3d97bdbbe00bc68ba06da6356b8

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
Size

244KB
MD5

cccc6563d6ec2f4b31a72592795147ba
SHA1

01bdcece3d320ba8e110b60d33cc95bd44bfdc21
SHA256

15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0
SHA512

eaebe3cf77a5ad43723704d8f195735e964dd476a210b4ad40b71159400af11567e3359bd9f0fd209dc5e7e656e2b0855a9756a4cdf4eb0c4aa180978c618e29
SSDEEP

6144:HNeZmQNbl/ZVFHVsPFoHqjaufM0FvZCGu5aobQ9Imy4mw:HNlObl/ZHioDufM0Fkd5aD2mH5

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3996	vyozh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vyozh.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3996	1204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	82
PID 1204 wrote to memory of 3996	1204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	82
PID 1204 wrote to memory of 3996	1204	15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe	82
PID 3996 wrote to memory of 2308	3996	vyozh.exe	83
PID 3996 wrote to memory of 2308	3996	vyozh.exe	83
PID 3996 wrote to memory of 2308	3996	vyozh.exe	83

C:\Users\Admin\AppData\Local\Temp\15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe
"C:\Users\Admin\AppData\Local\Temp\15676e5199913f6f2263bbb3ac5ebf1aab24703083bbcd0934a7c09ac7c0abb0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\vyozh.exe
  C:\Users\Admin\AppData\Local\Temp\vyozh.exe C:\Users\Admin\AppData\Local\Temp\gehccpdltf
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Users\Admin\AppData\Local\Temp\vyozh.exe
    C:\Users\Admin\AppData\Local\Temp\vyozh.exe C:\Users\Admin\AppData\Local\Temp\gehccpdltf
    3⤵
    PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gehccpdltf

Filesize
4KB

MD5
ca90529b1d776da2aa4e34a2cbfe6285

SHA1
6ee3a8438b5b371252ae3b6244439bf0c2697e2f

SHA256
47f9cb1338faaccaaffcad5a076d6e4ae5a7041b5c393b53b29d6f5fe08f3d63

SHA512
768943698acb7e01f6396b10690a263ad84fd8fe8da6944ca42907cba974d43bf22d18de70e98ff9024732bba81b7daf9bda26e9f7a7040d36a323fbd286abc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\oh3pmsvnq6u12pfsiun

Filesize
214KB

MD5
e419594f70d9fd2bfe630503ccb51ab6

SHA1
3f3c863f2f9a6206105fd5ead347a7feecf46a58

SHA256
d4225f54c7be7a20fabbc123ddd00a0ef759b4f9c7bc30df04725828bc540b5f

SHA512
85cc3f04feac5dadca8f2329f011e0e4227a583ebc80c558d87692ae0a03461794c46c123cfd5c807f63f833c2f8464078cd9af7c49f82de66c4ee2d1a321c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vyozh.exe

Filesize
7KB

MD5
cd213c05fe29d8ea2abebe71678b9828

SHA1
ac00f24f1d70bfc40909d438c93362e53e954fd3

SHA256
c3ef3d6c6f8b85e8d88363028d7058662fd32709836c707daf56e597570e3de9

SHA512
457d821f5c2965ea5c3e1dc50fd44bf0e67e175f109efd5ae61fd4d8d123bbb75c856b545008e19a8c56af601999d56cada617dc368d4ae8f02e0099ed72e23b

Download Submit
memory/3996-8-0x0000000000C70000-0x0000000000C72000-memory.dmp

Filesize
8KB

Download