a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2

Analysis

max time kernel
21s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2.exe
Size

764KB
MD5

5253be62ab5869e131bebd9a0502ea71
SHA1

88e05f3dc5a26c08c8f34a779894ac0f7cc080e9
SHA256

a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2
SHA512

1daf0686294802be9bfe3a747a4c409233773d82b52beb38c9ce6984a749cb63428632a38b93e308e9802411a572d32902c7a7489ea4d171c45a60835633aa10
SSDEEP

12288:xe8VO8tAFpzp6raoUnfM0wbN7bcurLraSatWFjGhiVg72IE8WD+hNJJ9nmsKnWqn:xe8GG8uuSSwjGhGgTEtwJ6

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2316	a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2.exe

C:\Users\Admin\AppData\Local\Temp\a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2.exe
"C:\Users\Admin\AppData\Local\Temp\a9576865a5f80b0294960f581c16742c7cb3361281b09594e1431929ab5778b2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
453KB

MD5
33dcaee67fc3b4ae32fbb2dccc4ed0d6

SHA1
6758980679c6529360273d3a5dbca2d665e68175

SHA256
48facd3f6c7afec3e03dcdb000e931b25b48667b3c0562b6a64aa6377d464c30

SHA512
fd5cb79d28fd5ed6c5a36565888bd3b2dc80ade559c83e08c704ac43d5e84841cc9b9bfc26aa7506c61ac82f5e350f8413b7e9f3990b2e0f45a9cce75a3b44f0

Download Submit
memory/2316-0-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/2316-1-0x0000000000FF0000-0x00000000010B8000-memory.dmp

Filesize
800KB

Download
memory/2316-2-0x0000000000920000-0x0000000000926000-memory.dmp

Filesize
24KB

Download
memory/2316-7-0x0000000076BB0000-0x0000000076C71000-memory.dmp

Filesize
772KB

Download
memory/2316-8-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download