d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06

General

Target

d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
Size

308KB
MD5

aeb339e181c69bba41fe2fb1e55f1b10
SHA1

3bb81a81e5536332eaefdb35db898c2d00d0a8a3
SHA256

d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06
SHA512

c4b32556bc9a9a3042d7f7e8c1c67abe6f2cf696580d39e4dccbca7364de14f083aa957b36bd73afc7f9e978220e3a480694f2f7e69cb1569e06cb54500088ec
SSDEEP

3072:tCtNsQBMVlV7zPkloChL/bmYkRwy0ZaMPdWTx4koqO1hxG3ehZgNa4Etv20dGJ:smQeV77e/bOyy0hksrG37/EA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2656	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	31
PID 1600 wrote to memory of 2656	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	31
PID 1600 wrote to memory of 2656	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	31
PID 1600 wrote to memory of 2656	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	31
PID 1600 wrote to memory of 2528	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	32
PID 1600 wrote to memory of 2528	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	32
PID 1600 wrote to memory of 2528	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	32
PID 1600 wrote to memory of 2528	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	32
PID 1600 wrote to memory of 2224	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	33
PID 1600 wrote to memory of 2224	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	33
PID 1600 wrote to memory of 2224	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	33
PID 1600 wrote to memory of 2224	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	33
PID 1600 wrote to memory of 2796	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	34
PID 1600 wrote to memory of 2796	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	34
PID 1600 wrote to memory of 2796	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	34
PID 1600 wrote to memory of 2796	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	34
PID 1600 wrote to memory of 2684	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	35
PID 1600 wrote to memory of 2684	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	35
PID 1600 wrote to memory of 2684	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	35
PID 1600 wrote to memory of 2684	1600	d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe	35

C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
"C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
  "C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
  "C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
  "C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
  "C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe
  "C:\Users\Admin\AppData\Local\Temp\d85d5705341402ac5bbca2b09c8b6457593b74b7d3154c85df27e5bdcc4e5b06N.exe"
  2⤵
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x0000000074051000-0x0000000074052000-memory.dmp

Filesize
4KB

Download
memory/1600-1-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-2-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-3-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing