2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090a

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe
Size 439KB
Sample250127-sdd2ratnhs
SHA256 2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090a
MD5 674d662b0b9bd30f01a078c5d4b27880
SHA1 c5431dba27b405b3ca5180d61284eae203d1a500
SHA512 06fc0ade0a3ea118859ae3eee935cc81cfc5db2015c8b9d5b3bfe605de596076369dbbbebffca40697a46a7da802ae2160b678d928b973e0349d6fc485a7cca5
SSDEEP 3072:OtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdO5lqwDwy03CDhRgxgTAH0URnCu:yuj8NDF3OR9/Qe2HdezwX2u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5016	casino_extensions.exe
1180	Casino_ext.exe
2260	casino_extensions.exe
4388	Casino_ext.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino_extensions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Casino_ext.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino_extensions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino_extensions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Casino_ext.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino_extensions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1180	Casino_ext.exe
1180	Casino_ext.exe
4388	Casino_ext.exe
4388	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3436	2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4624	3436	2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe	82
PID 3436 wrote to memory of 4624	3436	2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe	82
PID 3436 wrote to memory of 4624	3436	2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe	82
PID 4624 wrote to memory of 5016	4624	casino_extensions.exe	83
PID 4624 wrote to memory of 5016	4624	casino_extensions.exe	83
PID 4624 wrote to memory of 5016	4624	casino_extensions.exe	83
PID 5016 wrote to memory of 1180	5016	casino_extensions.exe	84
PID 5016 wrote to memory of 1180	5016	casino_extensions.exe	84
PID 5016 wrote to memory of 1180	5016	casino_extensions.exe	84
PID 1180 wrote to memory of 1764	1180	Casino_ext.exe	85
PID 1180 wrote to memory of 1764	1180	Casino_ext.exe	85
PID 1180 wrote to memory of 1764	1180	Casino_ext.exe	85
PID 1764 wrote to memory of 2260	1764	casino_extensions.exe	86
PID 1764 wrote to memory of 2260	1764	casino_extensions.exe	86
PID 1764 wrote to memory of 2260	1764	casino_extensions.exe	86
PID 2260 wrote to memory of 4388	2260	casino_extensions.exe	87
PID 2260 wrote to memory of 4388	2260	casino_extensions.exe	87
PID 2260 wrote to memory of 4388	2260	casino_extensions.exe	87
PID 4388 wrote to memory of 496	4388	Casino_ext.exe	88
PID 4388 wrote to memory of 496	4388	Casino_ext.exe	88
PID 4388 wrote to memory of 496	4388	Casino_ext.exe	88
PID 496 wrote to memory of 1480	496	casino_extensions.exe	89
PID 496 wrote to memory of 1480	496	casino_extensions.exe	89
PID 496 wrote to memory of 1480	496	casino_extensions.exe	89

C:\Users\Admin\AppData\Local\Temp\2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe
"C:\Users\Admin\AppData\Local\Temp\2f75f9893acedde8b33393869c510bfd5ab900e4b2be2a1e1585f04d735f090aN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c $$2028~1.BAT
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$202803s.bat

Path C:\Program Files (x86)\Internet Explorer\$$202803s.bat
Size 81B
SHA256 c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d
MD5 4777bf695815d870d27ed4a38a8f0840
SHA1 565412b5182bca7a221448dba78369c42d1c4a0c
SHA512 87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d
MD5 SHA1 SHA512

Submit Download

LiveMessageCenter.exe

Path C:\Windows\SysWOW64\LiveMessageCenter.exe
Size 453KB
SHA256 ff2423540a32a60f831829fac707eb4b74930473cba272acdfbacbdd886dfd1e
MD5 27d81a292ff624c9dffc664ad50629b8
SHA1 6c106bea177ee4e8775547e0c3854394a27613df
SHA512 1b53c9ee9540c37fc58085c44aae4c6d818c1ab35e24c23cb6e0d54105b93a8988f849e35babc7c7b54d3d31f086a170f847687cb74d2105e263cede7ac48480
SSDEEP 3072:wtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdO5lqwDwy03CDhRgxgTAH0URnCm:Quj8NDF3OR9/Qe2HdezwX2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

casino_extensions.exe

Path C:\Windows\SysWOW64\casino_extensions.exe
Size 454KB
SHA256 046112bfc034cac88d9b3e4a633a331a60918541b870dfbf32981a8e73096be2
MD5 15f15a88d816d70475107934bc9fa339
SHA1 a621da94cb9e9d7f037ba321356ce2f54e855776
SHA512 da7ff57a06f05bf948d3a8ef5bca53636f7fa8eb670fad0730191279054ee19547b9db0b52ded528056bb51f4e8c0639537d3cca8d05fed51e6d53784dd58a4d
SSDEEP 3072:5twizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdO5lqwDwy03CDhRgxgTAH0URnCb:juj8NDF3OR9/Qe2HdezwX2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

casino_extensions.exe

Path C:\Windows\SysWOW64\casino_extensions.exe
Size 449KB
SHA256 1beee6b59e5320b9d415511739bafec520f91e3838efc8760a8e6a685f8a93e9
MD5 ca87b45077c2bdbd05d7866f0c4e6b15
SHA1 913c8d348f69e56253ef9e720d75beb9a890a687
SHA512 23d29327a577d38a66bb696479f5ef493f6faf354b109a7f7d8ad4b6587fb1801e7554faf6fd1c691fc7e8582e4707a9fd2187d8d76ac466d67434952cb0bd5e
SSDEEP 3072:+twizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdO5lqwDwy03CDhRgxgTAH0URnC0:Cuj8NDF3OR9/Qe2HdezwX20
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/496-33-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/496-28-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1180-24-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1764-18-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2260-20-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2260-36-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3436-16-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3436-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4388-23-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4388-34-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4624-9-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/5016-11-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/5016-7-0x0000000000400000-0x0000000000425000-memory.dmp

Download