76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe
Size

38KB
MD5

b3013fc90fcc10c1fc474e77acebcd2a
SHA1

407d6b637773c1bf84291bbfc883394de45c49a0
SHA256

76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8
SHA512

0798c0594d0669fea038d67234eb91e8f54dbd1c411d737bbe09d3a4a5ab353b200641d3be0e6ec920fc45784d50aff779c94a1dbf42599c52ba5ef95640010c
SSDEEP

384:MApc8m4e0GvQak4JI341C0abnk6hJP+wMv:MApQr0GvdFJI34qTk6hJPIv

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe

Executes dropped EXE 1 IoCs

pid	Process
748	sal.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sal.exe	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sal.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 748	4304	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe	82
PID 4304 wrote to memory of 748	4304	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe	82
PID 4304 wrote to memory of 748	4304	76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe	82

C:\Users\Admin\AppData\Local\Temp\76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe
"C:\Users\Admin\AppData\Local\Temp\76286d890a070e13af22b0f048fb6f15c76f9c203de7a65fc87d3276db2ffbb8.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\windows\SysWOW64\sal.exe
  "C:\windows\system32\sal.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sal.exe

Filesize
39KB

MD5
7ed296db3b3a48f041d06ebeb79b2e11

SHA1
4f8381ebc4ebbb3181ec5ca676acc927c5c3b321

SHA256
86631fa9e7c91ba56b243f8260fb0fdd7b545a8e4aa05e8f6866469b69476f8e

SHA512
96dfbf0de58abdcc71c169a3c12f0c7c9e76a21b9cf6e9682e7d3cbaf2c6d993c048fb0e19646502c5c7284b20218d29eaa5c3493c360881be1b34b7f3c68215

Download Submit
memory/748-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4304-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4304-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download