446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f

General

Target

446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
Size

2.6MB
MD5

71da5e904d488e6e9c8ee81672536dca
SHA1

ecc69376772968943f974f5e9dc8613c7f98e485
SHA256

446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f
SHA512

87e35ba12d389c2b6457ea6e78e65bc038cf7200a89689863bbe7ee5ad16258c36e2f17dbcb2e5bf2043f7822653165acd2857190c8d435636db07f209ed83d8
SSDEEP

49152:BvIecdejnYm/lHJR5JlLt9fae800m3OMDLWjOvcWCubc6tX7uRMP6dILmpkXy1gZ:YeUmBF+erjW6vcNN6luRMP6dILmpkXya

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1576	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	31
PID 2484 wrote to memory of 1576	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	31
PID 2484 wrote to memory of 1576	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	31
PID 2484 wrote to memory of 1576	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	31
PID 2484 wrote to memory of 2740	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	32
PID 2484 wrote to memory of 2740	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	32
PID 2484 wrote to memory of 2740	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	32
PID 2484 wrote to memory of 2740	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	32
PID 2484 wrote to memory of 2828	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	33
PID 2484 wrote to memory of 2828	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	33
PID 2484 wrote to memory of 2828	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	33
PID 2484 wrote to memory of 2828	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	33
PID 2484 wrote to memory of 2772	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	34
PID 2484 wrote to memory of 2772	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	34
PID 2484 wrote to memory of 2772	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	34
PID 2484 wrote to memory of 2772	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	34
PID 2484 wrote to memory of 2716	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	35
PID 2484 wrote to memory of 2716	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	35
PID 2484 wrote to memory of 2716	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	35
PID 2484 wrote to memory of 2716	2484	446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe	35

C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
"C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
  "C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
  "C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
  "C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
  "C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe
  "C:\Users\Admin\AppData\Local\Temp\446b0fdcf0c64b121801a4854ffe721e1936e88fa31c9903a8f31ecfcb5bf58f.exe"
  2⤵
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-0-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000000380000-0x0000000000610000-memory.dmp

Filesize
2.6MB

Download
memory/2484-2-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2484-3-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2484-4-0x0000000005410000-0x0000000005550000-memory.dmp

Filesize
1.2MB

Download
memory/2484-5-0x0000000000650000-0x0000000000672000-memory.dmp

Filesize
136KB

Download
memory/2484-6-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing