7c7d4f4bbfb59172de4bd6c478c510f5d87c4f28f9952c4edd543ce798fe14d2

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19.10.2022-21.10.2022 Ekstre.exe
Size

254KB
MD5

acb287f5d33a3bec62620ef511cd3e6a
SHA1

975cec902942585321f353e27d41f7dc4bf5b1f5
SHA256

622fcde32b89e9dce35b3513aec205891045470cb1111cf1c88f939cd10065fb
SHA512

8041d5d84098881f1051b66322726ef79718334b766e062b139ed11cfdd622c1b498e110954cd56af74bdefda40b676afb496f4b2c3264dc44384fb64221d23e
SSDEEP

6144:mbE/HUbHvDIgYx2yMlMdhpE63mj1CRK/dt1ImTXfGaW9:mb/HMylMdhnWj1C/WM9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	oujsjnpvzn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	1104	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oujsjnpvzn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19.10.2022-21.10.2022 Ekstre.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1104	5072	19.10.2022-21.10.2022 Ekstre.exe	83
PID 5072 wrote to memory of 1104	5072	19.10.2022-21.10.2022 Ekstre.exe	83
PID 5072 wrote to memory of 1104	5072	19.10.2022-21.10.2022 Ekstre.exe	83

C:\Users\Admin\AppData\Local\Temp\19.10.2022-21.10.2022 Ekstre.exe
"C:\Users\Admin\AppData\Local\Temp\19.10.2022-21.10.2022 Ekstre.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe
  "C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 536
    3⤵
    - Program crash
    PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1104 -ip 1104
1⤵
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dgnetfwgwxi.n

Filesize
4KB

MD5
df0d19c758434ec79b2df3ed6b051a63

SHA1
46d2da8bfccfe08abe80ca3b061d8fb2dcceed69

SHA256
f4db6669e8ee95be76030c8bc895c8dd91897afe74af9a3c2a90dd098ede89ae

SHA512
7091c98f0b86e6db0640a7751778e283a523be1ad5e174c2a74ea4c92e4b92c4f042317c32fa751764ecca94a55dd097aa769aab563e4f9b4a13373e7fdbf5ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\oujsjnpvzn.exe

Filesize
58KB

MD5
a53bf35dd3f2a0ece1babdf99d98ddb7

SHA1
866e4d1315486d4f792e03449def24bf48fba2f5

SHA256
f27f1c46335ed31550b8fd38781e85fd498edaf77ffc7fdea7b32f044c5cc26d

SHA512
f0ea778f032871260b891116e880c1814a7eeb512b4f649c8a3d355109aed9858128477a8d2c1d12dac5ace5be74879dfd590b9959c309ce67d1879828f679f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xpjzddy.csv

Filesize
185KB

MD5
a673c10951267a6553631dace3a24cfb

SHA1
07f38a7a0ea1c4677c62fb85e6fb758875c0089b

SHA256
4fe1118d5bcb9ae4cb1204f4d411e792516b48c341a65c7d7a7e742560e379f3

SHA512
c7035f44a84398ce2d2668322efc950a838daefb2ef2ce6b6b007470a7347ad0ac62e99883a090c7ef20d93fdf7ab6bcaa42bd19152068808b966bd92d6123cf

Download Submit
memory/1104-8-0x00000000012E0000-0x00000000012E2000-memory.dmp

Filesize
8KB

Download