73181fde5ff61e6823ee4d189cf4a86f2426ad96cfbf774f819cdb0c27ef5859

General

Target

681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
Size

1.0MB
MD5

2e968b52eeb924243e635aa8839e0ec4
SHA1

e6c64ea9a9d353881349fdc357d26a93370dab52
SHA256

681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5
SHA512

7d61d90e37481730a2666d6f54eb97371ff27d87bb6294b193837cab11e88ffbda174cae75d3401a4798627bec18fe7662596630e63e496eb7ef8b49b0ba36f8
SSDEEP

24576:ERcGuyEEeKrvDB+/ExV9ogVayp1q2d3WP8e:Fgow91u2W0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2812	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	31
PID 1708 wrote to memory of 2812	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	31
PID 1708 wrote to memory of 2812	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	31
PID 1708 wrote to memory of 2812	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	31
PID 1708 wrote to memory of 2804	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	32
PID 1708 wrote to memory of 2804	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	32
PID 1708 wrote to memory of 2804	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	32
PID 1708 wrote to memory of 2804	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	32
PID 1708 wrote to memory of 2576	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	33
PID 1708 wrote to memory of 2576	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	33
PID 1708 wrote to memory of 2576	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	33
PID 1708 wrote to memory of 2576	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	33
PID 1708 wrote to memory of 2420	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	34
PID 1708 wrote to memory of 2420	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	34
PID 1708 wrote to memory of 2420	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	34
PID 1708 wrote to memory of 2420	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	34
PID 1708 wrote to memory of 2964	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	35
PID 1708 wrote to memory of 2964	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	35
PID 1708 wrote to memory of 2964	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	35
PID 1708 wrote to memory of 2964	1708	681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe	35

C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
"C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
  2⤵
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
  2⤵
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe
  "C:\Users\Admin\AppData\Local\Temp\681fe3b085850ef4d08c34692526d77bbe97a0363ed900e397f008a7274fa3c5.exe"
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000000370000-0x000000000047E000-memory.dmp

Filesize
1.1MB

Download
memory/1708-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-3-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1708-4-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/1708-5-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-6-0x0000000005700000-0x00000000057AE000-memory.dmp

Filesize
696KB

Download
memory/1708-7-0x00000000022A0000-0x0000000002306000-memory.dmp

Filesize
408KB

Download
memory/1708-8-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing