c1a148b353ceabecd13c5e1097efb20b13f0b46b2f15dd50bf906773a205d0e7

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inlaweed324456.exe
Size 216KB
Sample241225-bc2b8aspgj
SHA256 0d0f9826df61da68a73b28700102eb7c15f3d3dac4925b56b08a4c9ef89ab743
MD5 aa9acee000034360ef72e014b05e775c
SHA1 2e424b2812e789a76315fe7ee2977c2fb802e568
SHA512 1d881aed0cdfd9f7e0cb6a883040b763c07e9428627384984e23e65bd24e30897ed05881e106d1e55dd4b13a6d3b3682fb198299e53cc1b8d94aa28c420804fc
SSDEEP 3072:F14/IIhEDnmJ+xjJiGIykqSqbNjXGK86HBmx6k6qzUCa0lCVUyy+ZFsH5:FbUIZX58YQ8DqPa06UyjZF+5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1108	ughxrz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	1108	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlaweed324456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ughxrz.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1512 wrote to memory of 1108	1512	inlaweed324456.exe	82
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83
PID 1108 wrote to memory of 3448	1108	ughxrz.exe	83

C:\Users\Admin\AppData\Local\Temp\inlaweed324456.exe
"C:\Users\Admin\AppData\Local\Temp\inlaweed324456.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\ughxrz.exe
  C:\Users\Admin\AppData\Local\Temp\ughxrz.exe C:\Users\Admin\AppData\Local\Temp\kunwbqbivl
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\ughxrz.exe
    C:\Users\Admin\AppData\Local\Temp\ughxrz.exe C:\Users\Admin\AppData\Local\Temp\kunwbqbivl
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 600
    3⤵
    - Program crash
    PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 1108
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dsi54bg0l05gki

Path C:\Users\Admin\AppData\Local\Temp\dsi54bg0l05gki
Size 184KB
SHA256 84e167d1ed138c82b3e90a332e4cce207da3cbe6763c2d1f93d51e6ab7d7b8d1
MD5 ab7b842a222f7f292b046687f4beeb8b
SHA1 c0ebb3975cb4fa454c535915f2277cbda26c20e3
SHA512 5b212f17abdc3e5e35d70ac00e703a5d8664f569b0a07c3e143887016e58b104d251de6b0c136ec900bfe5c6047505d0c45014e8235e1b8992689a32cfbfefa9
SSDEEP 3072:5Nylv7U53oN/YSzWtYaVer85Y7o8cYPVB7L83FGaGEQim2Q1r/PyqRyy+ZB:Lyxm3AzWt9Y85Y7o89lL8/GGbA7PyYyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

kunwbqbivl

Path C:\Users\Admin\AppData\Local\Temp\kunwbqbivl
Size 4KB
SHA256 27eacff6815497d148c2661aae0883833a5b2df12ea05d573145b343c32f8e4c
MD5 ebcbecf083bd04fdc4f19036eced42ce
SHA1 59ac3f77b1c64b6f0aed95404e8a5ca6bab762cb
SHA512 4e6de66ba7564822e273077772fccf1d82dd90a87ad58c1a14a99d9fbf9a229dfb2ebb9a35cff1ad56f0c0ccff39b42bf36daf57810e9f0402a0cac470928ce1
SSDEEP 96:5OTzOQIYORJfN8aFrinhWfYw7Kwb1eNuAY0n:5O/OJ8QShWJ1xAY0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

ughxrz.exe

Path C:\Users\Admin\AppData\Local\Temp\ughxrz.exe
Size 4KB
SHA256 192fba7e71f2f2e0d53c8ac2b9a0ce20c489b8d8306e44cd025fa0fd3bfc5229
MD5 86ec26587378d1a1ff33ce1aa2680fba
SHA1 577ba29772044952e70cfab3f9c08c06a4272314
SHA512 e0c309435494918579379c4c1ccfc8f03ab8bd474c1f142179d5050bc99693ba08ea2cdda88e22bf1e7c12ac634aa15ed08dfd4b5a78e464c33ac495bf9f4f60
MD5 SHA1 SHA512

Submit Download

memory/1108-7-0x00000000006B0000-0x00000000006B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads