d7108405eebedbd1d610c13bd7dae066a7ca5497f7e1c8c977a92b8401083709

Analysis

max time kernel
4s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a58deb8862cf7fc15015cfdc2e12d91.exe
Size

40.5MB
MD5

2a58deb8862cf7fc15015cfdc2e12d91
SHA1

682e9293a26c82ad925ac044a72b24d523cb2ea1
SHA256

a46761f2e749190b048aa4d2c0d1e21d5ee0c2959102bd13d164f9ce7209299a
SHA512

2eb1a1f233f0cd6967b591d1a0b5cbf8f90b33d81ab543527c6846643aacb744f668dda259e726c8b27576916a6ce2490c13eddc58db630c4e6869b1de5c7aa1
SSDEEP

786432:xFg84K+BeqgXXr0YXHvHnoalAYBULMEN4Iler1X/C9WEVxdVdENwtfJgyI7zmb:x6K+Bngnr0ovDeL9Jlk0WEVj7xJM7C

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk	2a58deb8862cf7fc15015cfdc2e12d91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a58deb8862cf7fc15015cfdc2e12d91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4636	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3904	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	2a58deb8862cf7fc15015cfdc2e12d91.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3904	3656	2a58deb8862cf7fc15015cfdc2e12d91.exe	87
PID 3656 wrote to memory of 3904	3656	2a58deb8862cf7fc15015cfdc2e12d91.exe	87
PID 3656 wrote to memory of 3904	3656	2a58deb8862cf7fc15015cfdc2e12d91.exe	87

C:\Users\Admin\AppData\Local\Temp\2a58deb8862cf7fc15015cfdc2e12d91.exe
"C:\Users\Admin\AppData\Local\Temp\2a58deb8862cf7fc15015cfdc2e12d91.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 06:17 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3904
- C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
  "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp72BF.tmp.cmd""
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp72BF.tmp.cmd

Filesize
184B

MD5
2ef6312cdfc920c8cb63cfbecfa4e8ab

SHA1
a47fe1195a2d100b2ef86f0191787623417de9e3

SHA256
1543cdcdd7b466af1a52089b766f8ca5602c2b6fe3e0c130a3e6b38913c9f887

SHA512
3d40cf8c0a5c1bc78b8b05ec13168b76acfc497bbbd1e1b5efc917ab483c76667aef8fdd360a17baf14f8dc4f7fc52e1263d25b8f5835a3efcf6c5859a2c1f90

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
34.6MB

MD5
300804b4e60b558ff0c2beb58b0b4d0b

SHA1
d16d339defa5fc7dd29aecacc27a36e3c141faa6

SHA256
2b3d50660347e6fc5706a7fca2069c0a1ba7d54cd5e28968f228814fb9e95e21

SHA512
9666ecea64284bc88681b434540a9142970f10ab789a7563d42ad0f0718de88ae8150f41a3ea6aff73a606f3f78373f049a0b5cc736f3bb9c8a6d44ab5a361b3

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
37.2MB

MD5
6281839c46f9598bfb5600675536bb70

SHA1
f7856a1ac167d59c5b66b08952876ea642795461

SHA256
6422072ab9ce03da01db8c38b2801e617b4fee1c33f28e470c8e54f03eae7934

SHA512
4bb0173c5ed77d02194927cb6c8e80689957c3dc1d3b0fa3426e363294005f5da68dac0969171651458d54c4d474520f804de1815775585a6829627bf62f1a84

Download Submit
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Filesize
35.6MB

MD5
499195b0d4f7263a371e53d968d5f0e1

SHA1
ae19c393513c61ce43297635e46ce184d7ced3f4

SHA256
e18941fe2ad1f4f02e37acaea44dbabfb74b9790fc0c091e463db98f9da42e83

SHA512
b126167bb1a96da6773793f5c9567244c2ae1b198fca3e3be35b2149f521d34442ba37ded64a7d0521dc9c4834f4bc1ba9ead0ae8764cc594531054eb75b40f2

Download Submit
memory/3656-3-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/3656-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/3656-2-0x0000000005B60000-0x0000000006104000-memory.dmp

Filesize
5.6MB

Download
memory/3656-1-0x0000000000930000-0x0000000000AE6000-memory.dmp

Filesize
1.7MB

Download
memory/4356-19-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-21-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-22-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Filesize
40KB

Download
memory/4356-23-0x0000000006D20000-0x0000000006D86000-memory.dmp

Filesize
408KB

Download
memory/4356-24-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-25-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads