c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe
Size

39KB
MD5

8d806fb64d594970cbe712bbc06f8620
SHA1

b0d07d467612c82660bae118fe20400a33ed3935
SHA256

c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910
SHA512

9accc0bea950071fcb587da0c303694aa92843c34fd0ea78c343f1323efb1ab67bc18c68d2ee44cd2607ff9f83613ea73883c1e90c0fc69434b06e636ddfc989
SSDEEP

768:mzQL/qXL7g5AQRBIFGEjvM0WtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGWl:mUL/o7EjR2I0WtdgI2MyzNORQtOflIw7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	ghyte.exe

Loads dropped DLL 1 IoCs

pid	Process
2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ghyte.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe
2692	ghyte.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2692	2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe	31
PID 2128 wrote to memory of 2692	2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe	31
PID 2128 wrote to memory of 2692	2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe	31
PID 2128 wrote to memory of 2692	2128	c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe	31

C:\Users\Admin\AppData\Local\Temp\c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe
"C:\Users\Admin\AppData\Local\Temp\c8c9f4eff42a18309d0aee8589644d2c54060171e029801259a8a136a19c4910N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\ghyte.exe
  "C:\Users\Admin\AppData\Local\Temp\ghyte.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ghyte.exe

Filesize
39KB

MD5
daf53b340ea5c417890bcd65f2dedd37

SHA1
04e1b8910c3f487f63eea8f3f55fbf25febadefa

SHA256
faa20456369c2cbc6895e186c5485091165387f450659856f752cb930a1052e0

SHA512
07b57355b56b28b78b41984dc95930f8d063e8a4d0dc4fa26f6ab4349216398ee3c9ca3ec481b27f5b1289184177a9297e3fe7f395f626a5c1d5046f90435509

Download Submit
memory/2128-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2128-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2128-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2692-16-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download