c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe
Size

10.5MB
MD5

c15b5a4acadf4a59740b40cdb461a192
SHA1

030122f597c9aaa95b1b849f0a2442bb0a2385bf
SHA256

c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f
SHA512

35eeed77c2c5b2650c10d4c0f36ea0cfb652c02f897b44bf7e5a3e7046f5ea9f9da7b613fd5caeaa2470e35e336110114701b149978cfba89cd9a83a42398c9d
SSDEEP

196608:MzFsg6BXP4XAGFyxL/jBn1nG5lNniIbZg4TYc1vR31A4zur5MOjjDDTTVp2w/cre:MzFgWcbdebPH1AJp2w/HSk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2840	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2840	2424	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe	29
PID 2424 wrote to memory of 2840	2424	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe	29
PID 2424 wrote to memory of 2840	2424	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe	29
PID 2424 wrote to memory of 2840	2424	c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe	29

C:\Users\Admin\AppData\Local\Temp\c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe
"C:\Users\Admin\AppData\Local\Temp\c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe
  "C:\Users\Admin\AppData\Local\Temp\c168dacd7da92cc12194e02becaf9b51aa43f835a450db1accb0c24eafaea10f.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24242\python39.dll

Filesize
4.3MB

MD5
5bafe23107e6df19de8f7ac9068ed26e

SHA1
d2a88beaf959bd5331948b03330c98fe8fa85c7c

SHA256
c1e5a847ae6aa9d9f42b482c7a20dcdc9dfe225f7186b0b01924225aa4e5e581

SHA512
1c2372debc0e2e53ea281798f15243294430e4e7e4d3b82e4ab998a1b7c77cad68d50e196e37c6ff7ba83b08a12286af5d2797bfa707af5dad180862cce7efc7

Download Submit