a2e050c860a8e1cb1db99e4d572faf7733dfec1b3e78f923baba70328c984d42

General

Target

6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
Size

837KB
MD5

ca25cc1a0351513cbb0bb70343b03862
SHA1

69bf7182f7cd72ca775be7736b843345efbbdc0e
SHA256

6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4
SHA512

95d81f55e28b658cb8b6a53ab0d0601b49a2764fdb5e4f4a163fc88ba66538cc97ce11207b49c2f12b4ff9ecbbc3cca5d31f6b07c5113be80f21631cac7f57d0
SSDEEP

12288:WEoKggb2iNdvpc++HRBTEdG6gAGYN/lXXE5fRPcXUVtSlTOzYM2TgN/0s:zoKgK1XpSHbgbR04XWtUOmgi

Score

7^/10

discovery

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3180	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	101
PID 4032 wrote to memory of 3180	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	101
PID 4032 wrote to memory of 3180	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	101
PID 4032 wrote to memory of 4460	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	102
PID 4032 wrote to memory of 4460	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	102
PID 4032 wrote to memory of 4460	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	102
PID 4032 wrote to memory of 3984	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	103
PID 4032 wrote to memory of 3984	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	103
PID 4032 wrote to memory of 3984	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	103
PID 4032 wrote to memory of 4428	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	104
PID 4032 wrote to memory of 4428	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	104
PID 4032 wrote to memory of 4428	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	104
PID 4032 wrote to memory of 2904	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	105
PID 4032 wrote to memory of 2904	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	105
PID 4032 wrote to memory of 2904	4032	6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe	105

C:\Users\Admin\AppData\Local\Temp\6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe
"C:\Users\Admin\AppData\Local\Temp\6e294639b9e9dec345a4b9bdeb29bd5695ea2d84e0fa88633ece9e7e88ad2bb4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-0-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/4032-1-0x0000000000DB0000-0x0000000000E88000-memory.dmp

Filesize
864KB

Download
memory/4032-2-0x0000000005F40000-0x00000000064E4000-memory.dmp

Filesize
5.6MB

Download
memory/4032-3-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/4032-4-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/4032-5-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/4032-6-0x0000000006660000-0x0000000006684000-memory.dmp

Filesize
144KB

Download
memory/4032-7-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/4032-8-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download
memory/4032-9-0x00000000070A0000-0x00000000070AC000-memory.dmp

Filesize
48KB

Download
memory/4032-10-0x0000000007240000-0x00000000072B6000-memory.dmp

Filesize
472KB

Download
memory/4032-11-0x0000000007360000-0x00000000073FC000-memory.dmp

Filesize
624KB

Download
memory/4032-12-0x0000000007400000-0x0000000007466000-memory.dmp

Filesize
408KB

Download
memory/4032-13-0x00000000072F0000-0x0000000007326000-memory.dmp

Filesize
216KB

Download
memory/4032-15-0x00000000751D0000-0x0000000075980000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing