d7108405eebedbd1d610c13bd7dae066a7ca5497f7e1c8c977a92b8401083709

Analysis

max time kernel
3s
max time network
128s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a58deb8862cf7fc15015cfdc2e12d91.exe
Size

40.5MB
MD5

2a58deb8862cf7fc15015cfdc2e12d91
SHA1

682e9293a26c82ad925ac044a72b24d523cb2ea1
SHA256

a46761f2e749190b048aa4d2c0d1e21d5ee0c2959102bd13d164f9ce7209299a
SHA512

2eb1a1f233f0cd6967b591d1a0b5cbf8f90b33d81ab543527c6846643aacb744f668dda259e726c8b27576916a6ce2490c13eddc58db630c4e6869b1de5c7aa1
SSDEEP

786432:xFg84K+BeqgXXr0YXHvHnoalAYBULMEN4Iler1X/C9WEVxdVdENwtfJgyI7zmb:x6K+Bngnr0ovDeL9Jlk0WEVj7xJM7C

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk	2a58deb8862cf7fc15015cfdc2e12d91.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	apihost.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	2a58deb8862cf7fc15015cfdc2e12d91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a58deb8862cf7fc15015cfdc2e12d91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2696	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2560	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	31
PID 2236 wrote to memory of 2560	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	31
PID 2236 wrote to memory of 2560	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	31
PID 2236 wrote to memory of 2560	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	31
PID 2236 wrote to memory of 2828	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	33
PID 2236 wrote to memory of 2828	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	33
PID 2236 wrote to memory of 2828	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	33
PID 2236 wrote to memory of 2828	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	33
PID 2236 wrote to memory of 2836	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	34
PID 2236 wrote to memory of 2836	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	34
PID 2236 wrote to memory of 2836	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	34
PID 2236 wrote to memory of 2836	2236	2a58deb8862cf7fc15015cfdc2e12d91.exe	34

C:\Users\Admin\AppData\Local\Temp\2a58deb8862cf7fc15015cfdc2e12d91.exe
"C:\Users\Admin\AppData\Local\Temp\2a58deb8862cf7fc15015cfdc2e12d91.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 06:16 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2560
- C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
  "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE6B7.tmp.cmd""
  2⤵
  PID:2836
- - C:\Windows\SysWOW64\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE6B7.tmp.cmd

Filesize
184B

MD5
f109ee20603d29b35caf2d1515ddfa70

SHA1
73d841155fa37ca3aa659877dd6461320121f515

SHA256
114831771c46565d48a1a925d0bb93ba1310a9a26096fc4df4bec2ed4ed3499b

SHA512
edcbff07a8413bec4f4eb7cfaf3c01d21c64742c4b2b57179d7b4b7c754817245a50da557b124ea844a7c6f7df1ab6fd215f6566d233e8fb5ab2dd8a6cf1a144

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
34.6MB

MD5
8b2720cf82e8933ceda9d2f7bf56295e

SHA1
5fbba26090ab6bf50c047aafa83a7e2e4fcbafca

SHA256
af41246186b35db53ddd8c79a8e4f0aec7c85d9daf6cfabd0f6b5c8919d73ec6

SHA512
27d45cb0422cbeaffa8923e0a9d6d4664b2091ce4a5335317a9f8c1ad2cc6d1b340a52516b76361d533f778755df5391497e57a92bee19e29a21115c00474025

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
38.1MB

MD5
714b4387e550e4c4a2636fb87a861293

SHA1
7263e68adf6f32d274ba0c552cdad16d5bb933c9

SHA256
a1187618167dde5872cd5d5f333472f8e3e6d68fb313032ddce8ac8e56f21b45

SHA512
b63a68318ded75b0cb04392c510eb1a77d53884fbe6809a91e2b03f7ae1303267535746881d58f77ea9e2d5e115cb2595ab1ced091f0ae8fe94a3ac4dd4438a7

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
34.9MB

MD5
07826f72963b6528d976f2eea8ccd329

SHA1
b273c497f2f2dce36813325d1d394f92d878cf9b

SHA256
69f22f0eea4ad6526f2751826ab880367b260bedfb482acce729e6dc8fc1ec55

SHA512
16a6ce4c668ee5d2dd06f426064a8f7a02ce63cbf2a3f97d078fa52865208a7a8de64b9275cb990d45c75a2f00addd57396756078d56fb569a6f1c68e78d9e1f

Download Submit
\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
35.6MB

MD5
499195b0d4f7263a371e53d968d5f0e1

SHA1
ae19c393513c61ce43297635e46ce184d7ced3f4

SHA256
e18941fe2ad1f4f02e37acaea44dbabfb74b9790fc0c091e463db98f9da42e83

SHA512
b126167bb1a96da6773793f5c9567244c2ae1b198fca3e3be35b2149f521d34442ba37ded64a7d0521dc9c4834f4bc1ba9ead0ae8764cc594531054eb75b40f2

Download Submit
memory/2236-0-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000940000-0x0000000000AF6000-memory.dmp

Filesize
1.7MB

Download
memory/2828-20-0x0000000074DD0000-0x00000000754BE000-memory.dmp

Filesize
6.9MB

Download
memory/2828-18-0x0000000000EA0000-0x0000000001056000-memory.dmp

Filesize
1.7MB

Download
memory/2828-21-0x0000000074DD0000-0x00000000754BE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads