bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2025, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe
Size 1.2MB
Sample250110-rf7leaylem
SHA256 bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76
MD5 8057aaa332a2045b3acb5040bad45772
SHA1 224c921be20a4e4c3b627f0dc01bd5c896ca122b
SHA512 6215152720aab91a7f4ed09d444cac7a44a9f053c2adc5f8a2cedf8ac874c4db042183213020e57175719233f1b1a7659bde6337e6dec1b66c4c2c4607732773
SSDEEP 24576:1tb20pkaCqT5TBWgNQ7aHfIuPco8vnw9na4ntkCLuYwq/ch6A:mVg5tQ7aHgNpvnwpjz/85
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3524 set thread context of 2096	3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe
2096	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe
3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe
3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2096	3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe	84
PID 3524 wrote to memory of 2096	3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe	84
PID 3524 wrote to memory of 2096	3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe	84
PID 3524 wrote to memory of 2096	3524	bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe	84

C:\Users\Admin\AppData\Local\Temp\bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe
"C:\Users\Admin\AppData\Local\Temp\bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\bb04679008a1ac6bcd8ca7ff7470e0ee72450562fd87be1e0b8111f0e7ef2d76.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autC2A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\autC2A4.tmp
Size 280KB
SHA256 2b2b19222e0c610331cd073caf812c0c96bbd4b8872fa358ed800da92e6f642f
MD5 60da3c5734adc25f78600be77434d88c
SHA1 447b5cafcfda9b7ef6997dfb1670de369d03ec4d
SHA512 5b4010c91ecc7873bb68a0ecddf91fb5e01b952f1465e1099b38d5450e61d2a946995bb08459fafd1a5cbf61bf0b06f04f4ed62038bed122c0575a7c6901b457
SSDEEP 6144:E6l7sN894VVdIdT7OHROzYBCKtBHW65iDHGeiUljSqSaB0gxBXwWrl+o:R8g4LNHuYBCA5Vwl5BrxBAKAo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2096-9-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2096-10-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2096-11-0x0000000001000000-0x000000000134A000-memory.dmp

Download

memory/2096-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2096-13-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3524-8-0x00000000013F0000-0x00000000017F0000-memory.dmp

Download