616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-02-2025 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
Size

1.1MB
MD5

85a952db819fdb0faf89469707175466
SHA1

4d08431c60f0cd0e79048a3e5f8a4d50a5d89b66
SHA256

616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f
SHA512

7b289fdb46d3ee0dddcfe1e7bedfc4ac6b0a3749ac028e4d0e4e91cd94e3598f57eeaf3497022f5935b1e0e12bafb27d27848793eb9e2ffdf00fa68cef41d668
SSDEEP

24576:qfwUrb8d7cUUe1+bpIuKTRlfKcP7Ixz9h4qNBSeIh9HD0J9Caq0lUK+fuTdTd:jCb8l51+FKInzwF1jLaq1ad

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nyn\telefontidens.rel	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
File opened for modification	C:\Windows\SysWOW64\epicentrene.boo	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Indbygg.Bag	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Privatlivenes216.Hel	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\untimely\Ubevbnet.ini	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
File opened for modification	C:\Windows\resources\uafvendelige.Ali	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	2396	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 696	2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe	29
PID 2396 wrote to memory of 696	2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe	29
PID 2396 wrote to memory of 696	2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe	29
PID 2396 wrote to memory of 696	2396	616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe	29

C:\Users\Admin\AppData\Local\Temp\616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe
"C:\Users\Admin\AppData\Local\Temp\616bfb78e139a9149abd2b16353af1c566eaae58e0366d9536cfca1f3cf9587f.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 472
  2⤵
  - Program crash
  PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
43B

MD5
11598c9bea98b902fd23f62d92e2c755

SHA1
5abf26b3891bde2c11143deac679d44d5af7dde4

SHA256
e57e26e68b9ee25d136d2b440e28ffc09be1233efac52ec2f050c098a7e8090c

SHA512
aa6045bade9bee63b80e2822d1e17ed4186202c8ba840af93f4d14dad4a2d32790e1ffd7448b4cbc8b92891967174cf70a54d2aa5957f3b266da7bb61d8f6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
52B

MD5
ea70cc86528476e4f1225362996952a6

SHA1
93851680188ae3f06e0b419fa5afe38de41b84eb

SHA256
86ecd210e4942095595b70f160ce629c222229b154e64cf97295beb83ade9f63

SHA512
86c4fe02a63c61776b1cda0bca20e87f97a0103d0e9e914e913a5047d2660a804f18a754029f4d1877010d9027968c20107862da56e0033529f9d58a26cde836

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
58B

MD5
0b29799f668498e44f469590f92136a6

SHA1
477022e40d3b1f1f06f5e6c0404450af702db6eb

SHA256
9b9b769252e232ac369f61922b79f5656a4f4d744e39114bd389d0a56469ce3f

SHA512
d987b05f4085bc9d3640e496f002e068649a2859f0aa6c538de03ffac0f766dc0009a6f532809e579655ad5677a150834447670fb2774d1bdd33b70542ff3ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
64B

MD5
814da453daa6269ca4ed4cd15266b28c

SHA1
82981f8c0d5d3ffccbf06fff867f8c3b1aaa454b

SHA256
791004efaa6a41452708fe5db95097b4681e4f4d386e33b8044088b8f736d743

SHA512
3336dbdf67c28567e9cd6a495e2e7d7e7fca21fccdff35b7c84588237829c32f69be5f733cbc3e3bf1614868a3e9e6000c5ff3116b4cc035723c37ca743cb948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
4B

MD5
cde63b34c142af0a38cbe83791c964f8

SHA1
ece2b194b486118b40ad12c1f0e9425dd0672424

SHA256
65e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d

SHA512
0559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
18B

MD5
1a42166fa1e8a360271d4fb25c78fbda

SHA1
f4d1ad6ecdc1202a2c08c03514ec814072b818d2

SHA256
b271abd85535886a3753ee0a5e8957a1bf2e502c4a275d1d8f7f5ddf3b7de292

SHA512
ee3342a9a407bfe56e7c65c1f1c0b15624fbffc60c88ff9e404a1dbebcfd606f42de8cb61624f992f57fca2e05d75a64611a78e508c7772ffaeb9c5924c87c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6A0C.tmp

Filesize
24B

MD5
42e9d16f22a223f11084f22b94b42210

SHA1
7f4dcba6193c831687f6a1cac9b60231be8a6a1a

SHA256
0717d3c2c8ad4b25752e43514cd4352de08c51bb9a8d153beb842dd421677b91

SHA512
a965c1381a0179e1bb1600fed3065741ebacc8c1e0a73db5d0db4eddbe5a45ec42cbd489a525d5c5151f52188daf367d0740e6555d9e41c1385a2fed4b7a6ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
2B

MD5
25bc6654798eb508fa0b6343212a74fe

SHA1
15d5e1d3b948fd5986aaff7d9419b5e52c75fc93

SHA256
8e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc

SHA512
5868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
7B

MD5
67cfa7364c4cf265b047d87ff2e673ae

SHA1
56e27889277981a9b63fcf5b218744a125bbc2fa

SHA256
639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713

SHA512
17f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
20B

MD5
c107db39d0997077c3355387b58642da

SHA1
ccb33ed432ab7bf44d4613c12593739e1ae32aa9

SHA256
d30356374aa30cfbc7c370471ebd3eb85f2024b777d159118b830c6e249003b8

SHA512
856bc5968be310569a4e657c240311bff57c2ca1489f0b391b192ac111ecf377ea0e300b8abb270de4fcfbc4f374b98f850c7538f3ee3ddc166279116e1e5241

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
29B

MD5
90d4148f2c3df01640574cf198642bff

SHA1
80df93c47461df2096af940f6ff710cc3b103a5d

SHA256
603018413ce2875406e3ef08d7ba9a2f086539f1d1ed1023efea06b635c426fc

SHA512
0e407fe7c335c47b7a81cd77fc17b3db6d179342b3d05d103663e5fa7780d9d496e4a9ea462dc5f66cc4708a67c02aec395a08d73b6e52f3c4fa490b89ac4d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
38B

MD5
9d8ee7dd2b5b3dc165cfd974aecd1e1f

SHA1
94de57c2c74d98edbc4f8a0c706dd9b3eaded6be

SHA256
a4497dcf195cd9cc12f8df54946fbcfe5e048edd83e4abe01358274e7c8b03a2

SHA512
670531da15aa774d463845868f54bb64acd61517f1f13d05c608b7c27e1c4c6736830e6ab2d205abe63a81227715364cf2cee0b890d95f9ff59cafa73deb5729

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
48B

MD5
851bc598e378bce0333634a185ac284c

SHA1
17577393f8694c1483acd97611c4a64f44faeb75

SHA256
a7e9740f2516be22b4d0579b07bd0e1815df7b5822f60909ee392c0b0ea182e4

SHA512
d90fcdfc01fb519082ac36f27c081f876fbf7a6d81f5d4e3a0da1dee10548af276d7c9250289dfbedd4760265d06539f03164dcc5530c719d8d51ffc64d82f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp6F3D.tmp

Filesize
52B

MD5
31f2698ce155bbce2ea3ab06962070da

SHA1
25d28773c69ce71ad043031619e34cc07c7a929c

SHA256
74add2157e2a21c1f519b2813ab014e33e3d76f00ccb33fad9ce4c5beea0d644

SHA512
0b371702e7406874360b921a0225fcebeb4c1369c3a271bcb214de4dcfa160b98daa16ee145fcd6bf8d551f6d5b4afe8ed8aa66b977583c5c1c69eabc478ccdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C00.tmp

Filesize
6B

MD5
50484c19f1afdaf3841a0d821ed393d2

SHA1
c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b

SHA256
6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c

SHA512
d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C00.tmp

Filesize
12B

MD5
f55b9d6e5f20db4066c68219d6cc7244

SHA1
b3a70fc3ea2da60d58274d9466a88a1e57926356

SHA256
9c2c033694acd2ee629918b688ee91e0032e6d2fa5cbb6b39a13e50024e73e01

SHA512
35bde19664ead683e639f42ed8447eab5bac8a1ac873efde467439e0631e3ece634b90e25140e62f46189df57f5c8fb6af44a8062ca9750514f8571d5860f2e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C00.tmp

Filesize
19B

MD5
43157868a196cf407824a5411f44f7e2

SHA1
7752306ef99ff3506a6ff41cb71d0c347b932565

SHA256
12a5b941c522748da012db793d839e52457ef62d7964de9001a30469f69e05d1

SHA512
322383a4d970f07ba4e00417d42054ea58347b5d4d068b85669d9512380c772f80788358d579a0419df634855711877478bc67bd1e7d2f8f6d30c63f63368852

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C00.tmp

Filesize
31B

MD5
bebdffa37358b59c6d03d4e3947c6f6c

SHA1
bb3d6a0095f4d6d2dac15bb64ffd4775952bf547

SHA256
3e3573216f1f8de74e0c00566b297b31f2c5b0e1015114d370fb84cfcdbe97d3

SHA512
651f98e9cf38c74647806c574f807c6a84d3b60c25aa701c00ad0cac409ff99fa490169ee033ba4ab1aa97dd8010c887d21d1dd1219bbfe5ae81ab39991efdbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6C00.tmp

Filesize
40B

MD5
288ddaeead52cc6f01034b0ca08e313d

SHA1
849306d8ccc2366251d6dbb07ba2447f800b121e

SHA256
5a3785d2999bdf1992068d247a71a7acc4946c13f17c880635dfa9e48fd2eb2e

SHA512
6101434e23c1bb35be4691de56dca636e4dd713d6ec9f1815b450af666b858b29a96bdae786be376dc312043ab19a3a88789816bf0023e363a703c551645d650

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
5B

MD5
e2fecc970546c3418917879fe354826c

SHA1
63f1c1dd01b87704a6b6c99fd9f141e0a3064f16

SHA256
ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0

SHA512
3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
8B

MD5
c3cb69218b85c3260387fb582cb518dd

SHA1
961c892ded09a4cbb5392097bb845ccba65902ad

SHA256
1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101

SHA512
2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
10B

MD5
9a53fc1d7126c5e7c81bb5c15b15537b

SHA1
e2d13e0fa37de4c98f30c728210d6afafbb2b000

SHA256
a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92

SHA512
b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
21B

MD5
cbebbb257a8311891f9bfccf5355e077

SHA1
b92ad8024d7b255165e48c519e71ed780d928cda

SHA256
4b53da02410254217ce2ca226b04cac355f795702acacee4695092b5c58af01a

SHA512
9b775b4e202b152996e5b0cea8f2c410026d7a75a3d66168051bc86dde49ccd11f1d8e49ab87a2ce7608d32a832bb3ed2e56319cb27e6890355fc87cf910f295

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
29B

MD5
5b2357aa9ee8d93ebc8fea2a7da01fda

SHA1
3a5bb5ceeeb26ee649ce9c8fa1c47e45d8c8f00a

SHA256
f2b723416cc41c59b870a8fbbe8ecab3cd0cf2298902649a50668b1b88e6e835

SHA512
03d9cbca3d09de197530779f90b8864da4a34aa50a7dc87fdd964ac53a5a6a73f543fe5727fc2df29b9cf5b3646b1ffc60b90883148c1989fdbcee5658582fe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
41B

MD5
695e426444e504ff96c80e54a2cc37b6

SHA1
9a1e939f533fcbb4184cacbc9040691c0181c062

SHA256
10c4d512e5970ced844ca34cd16c802b9d85970602bacf46c5f3fec01a8a069f

SHA512
f887d412ff24de198cfd8f014a1cd83cf1dba039872a433ec61a45774ae072d63fb9bd692af7d10b6cfd1379d0b95baaba5dd8ca8f8502dbeb1c525c76bda2c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz6DA6.tmp

Filesize
50B

MD5
569a80f6ef53f51dea397c0d0b7af31f

SHA1
0496025403dd6831a0e2a1cc5fa75b0767a4b6d9

SHA256
30ad6cc199c0a0d2b0bb0a676381bbb78f92e0c0a66b5e167acefe413f678796

SHA512
3e8b68ae0474c7d05b746599f8d55e37a62b86f434f67076ff124ae69dc404a189e49d1e3d09852095b5d3e4bcaa65b8cc67231c18fb391cf767b07e9ed4534c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz7150.tmp

Filesize
10B

MD5
fa5eb52a9735c883abcf72a7f9cf2254

SHA1
a043e3d3df1605300a2f5629ad7a302082814956

SHA256
40ccdff1a037de0fb10d03ea9fe79c2c96e7f18c3c7dffd92b42c2f0ed749116

SHA512
983e3f605f34f74e95db170da28f2584a74bf4d0047ea76c905c409e624d9db2a439e70beb07d8f879fb25549da52bb9cac6304281e2582d6e5b1b4f12ac21f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz7150.tmp

Filesize
20B

MD5
3bb6070b3e4cbc844c6cee699666f746

SHA1
eaeb87f3175746d3c8a0896e35f5f2d3ad4f2d7b

SHA256
8678054a5a992d44bb69e4ab770e4d17cd1530511f044754ba3a15e59121cba4

SHA512
cf53f306a00ef5ed498c1dcaa426b013a64520938f492d77cd0f1cc15dffe37d465f30b9e15d451e1f85ed8e67f2ebed0930302ddb94b2f7172dd9e4fd6c52f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Undularly163\flankens.txt

Filesize
52KB

MD5
990fae344087cb2dde31a3be2a22932b

SHA1
6716b7b10411710573f0de910d0afcd854c234e3

SHA256
263d609e6005c688f6b781e5bceabb770f38ae2d4c6249466ac60183e20eceb5

SHA512
124113ad55edc3447fea6c96eb584ef81e32290351d9923d0de98b6d5c72d3f00a16acbbdcfa09551b10836c1fa2fffaab4c7d2ef6b4221dd32c66219703a29e

Download Submit
\Users\Admin\AppData\Local\Temp\nsp78BB.tmp\System.dll

Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit