297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe
Size

270KB
MD5

97f15f12d2778d6df20309dd1065d9f7
SHA1

8f12b2e99cbc86c13bbcb87b5bc1d0fb17c763dd
SHA256

297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea
SHA512

7edccda9b817662969b2923a51c1bf0d6b0ebac647f7ed5c3027a1dd376006d6c4f8468b050edbe325707b32cae09b47b3af90886f3238e216d2b3d86fc48b7f
SSDEEP

3072:KIxWTbVeUXBwAEy6oNcdCebTJw7VcHBCANU0ti99UlgYJdC/KUPyINWsrMLgbn0o:KjHQUXBwO9eCANTti9CEbKQkghV/DvV

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
320	297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\BASSMOD.dll	297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1992	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1992	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe
"C:\Users\Admin\AppData\Local\Temp\297dc63b6214ce980f149ec4f450bdd6ad464447a17a4708e83f2a396a3aabea.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\BASSMOD.dll

Filesize
10KB

MD5
7bac2c6f66524cfc55ae91ddf3ece2dd

SHA1
afd526ca6629c5a6c851d66a2983099a3007935e

SHA256
b10a2f9f733227ec0edb6ed37cb3c8b592b0ae4e4bcedfb650bfc7622ac6aa71

SHA512
4f81516e273d02404e41fd54cac8b5fbe87465dc5554f5665e1b9a4107ba9a9ba34a9222a0061836a558d6db198c0774f98b022992c41750ec2a947dd3bce2bb

Download Submit
memory/320-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/320-1-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/320-6-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/320-7-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download