05eb96594a5dd8b1f7aa1ed1940141687d5afd65e873e5260bde36dba6d840d8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CCGen&Checker.exe
Size

21.7MB
MD5

e17e00443cf43f0e1cf5b933aca4c3bc
SHA1

a4b2aa57df313a3ad7eefb4d0bad6afe73b5b96b
SHA256

05eb96594a5dd8b1f7aa1ed1940141687d5afd65e873e5260bde36dba6d840d8
SHA512

1730ee22ad569d0563466a6d76575043753db3540013c56d2fd28d53e3113adfb618aa7cafe5c9c667e62bf143c94b28c13d562eeaef3d432dbba1ec7ed88b2e
SSDEEP

196608:Pa0zvsGESmDgfJXE3JuMhmAv8JLk+7r8ZaELdzsrRAvH+BVVWcYKMcn4Uc+4YLb:ShGESmDgBjMp0xk+coryvH+yKMcR44b

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2696	CCGen&Checker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCGen&Checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCGen&Checker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2696	2236	CCGen&Checker.exe	30
PID 2236 wrote to memory of 2696	2236	CCGen&Checker.exe	30
PID 2236 wrote to memory of 2696	2236	CCGen&Checker.exe	30
PID 2236 wrote to memory of 2696	2236	CCGen&Checker.exe	30

C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe
"C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22362\python312.dll

Filesize
5.6MB

MD5
7b82b2c836d5eb583b08f2545448f4e4

SHA1
53d9bac84ee353139087bd70a0bf75a366d3d470

SHA256
4a9f35b5c403b755fafacfe04dc9dd965df02d17710dade9a7b105af6aa75f3e

SHA512
af8e07bcf55d9f867772a02416f87c9ca7035154cf4e64859272babc8ab637258f85228dcc356bd5b1c4504d82aed9b93bed42fd4446dfa6513291ba9977ab89

Download Submit