458bea34eadc7f3901639e4a00146257a48decd88b6c6d93fe498a7b9e5cae51

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roarland_Setup.exe
Size

689.9MB
MD5

fd73cdaf9630ac3a86320de4d831d994
SHA1

e03a791836dbf283fbc47e257c9aa8ec8d26f0a6
SHA256

450fb432284ba2ee08c2cb3464286aaee9826fc23b1bfe72d7731c6aced05cb6
SHA512

b10a3217e73eed2851b2ac071f47f76d5e86cd21d7b9e1565b0a3d0e2d82bd9983cb91fec6008306811d2af35d453363962f377dc2a53d57e625568bc1330a12
SSDEEP

196608:eUWlPBFhD0f4P43aWKbFFM6oFPGMTjctr47i+tsYGC0t1JCbfJmYLTXzGf48o1cY:qPBFhD0f4P4t+FFMLnjcC7i+tk

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2736	WerFault.exe	27

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roarland_Setup.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2736	Roarland_Setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	Roarland_Setup.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2712	2736	Roarland_Setup.exe	28
PID 2736 wrote to memory of 2712	2736	Roarland_Setup.exe	28
PID 2736 wrote to memory of 2712	2736	Roarland_Setup.exe	28
PID 2736 wrote to memory of 2712	2736	Roarland_Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Roarland_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Roarland_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 252
  2⤵
  - Program crash
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1a8a8c47

Filesize
3.8MB

MD5
b22d20e2985f86d2d6fd235b266805d2

SHA1
43eaa994e7713f32784d0912b620696d3f1cf2af

SHA256
88f7f7af574a9cf65f757de2310dad2844bd4d3070e7f42b33129977512bad4c

SHA512
eb49abb9001f74e2461ee7ea6d275c6a1e11fefafbd9b696904d95c01a2c5391c61bc1eddfdaf36df336b2d98a86a0b5ae2c594b6cdb40565cd3a53ae97d9ba3

Download Submit
C:\Users\Admin\AppData\Roaming\Roarland_Setup\Roarland_Setup.log.txt

Filesize
4KB

MD5
ee832898418798c767e133ded432774e

SHA1
aa0d84d06f7c547aaed85b46140c4a1193b671ef

SHA256
db0e7e0ce3cd22a73c64082631d507af76dbb3a48a7583593bccb3351fff6602

SHA512
de47a59b5ef17ead39656975412a4604e8191f472c75aa1e23043b9db3ca5472c0aec5aa7e4e90b1d6c5bbfb9a77c124cff7b6fa740f4bfe95f5059b938347e3

Download Submit
memory/2736-0-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/2736-6-0x0000000000400000-0x0000000000E04000-memory.dmp

Filesize
10.0MB

Download
memory/2736-12-0x00000000758A0000-0x00000000764EA000-memory.dmp

Filesize
12.3MB

Download
memory/2736-13-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/2736-28-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/2736-27-0x0000000000400000-0x0000000000E04000-memory.dmp

Filesize
10.0MB

Download
memory/2736-29-0x0000000000400000-0x0000000000E04000-memory.dmp

Filesize
10.0MB

Download