Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 14:48
Static task
static1
Behavioral task
behavioral1
Sample
d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe
Resource
win10v2004-20241007-en
General
-
Target
d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe
-
Size
2.3MB
-
MD5
a031da4bae8bd9cf87c071c94f67d21b
-
SHA1
29146f6e8d3107eb8cc5b362b15d8e57c3f815fb
-
SHA256
d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f
-
SHA512
bd84ac0d0d3a846b5eba97d7a440f79034bda7b381f836966561175e98aed3d87e194441da0a19836c6acb3ec8293970efecb46767f303fd12956a0db9fb0b42
-
SSDEEP
49152:fu0c++OCvkGs9FacSc9fbFtWR1+0o8fyNq6UQruXZO1KgRudguKB+kyo3zJ57O1Y:GB3vkJ9Qc9jFs/QzNDogRudgLB/ySzry
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lecheries.vbs lecheries.exe -
Executes dropped EXE 1 IoCs
pid Process 3400 lecheries.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000c000000023a9f-14.dat autoit_exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2452 3400 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lecheries.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 3400 lecheries.exe 3400 lecheries.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 3400 lecheries.exe 3400 lecheries.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2304 wrote to memory of 3400 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 84 PID 2304 wrote to memory of 3400 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 84 PID 2304 wrote to memory of 3400 2304 d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe 84 PID 3400 wrote to memory of 3252 3400 lecheries.exe 85 PID 3400 wrote to memory of 3252 3400 lecheries.exe 85 PID 3400 wrote to memory of 3252 3400 lecheries.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe"C:\Users\Admin\AppData\Local\Temp\d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\konked\lecheries.exe"C:\Users\Admin\AppData\Local\Temp\d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f.exe"3⤵PID:3252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 7003⤵
- Program crash
PID:2452
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3400 -ip 34001⤵PID:3612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5a031da4bae8bd9cf87c071c94f67d21b
SHA129146f6e8d3107eb8cc5b362b15d8e57c3f815fb
SHA256d746bf8ebc1bc19872aafe6329fd3865332165c7ef477901e5cdf76e88e9931f
SHA512bd84ac0d0d3a846b5eba97d7a440f79034bda7b381f836966561175e98aed3d87e194441da0a19836c6acb3ec8293970efecb46767f303fd12956a0db9fb0b42