eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34

General

Target

eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
Size

368KB
MD5

3b6f01867a856980aebf4bfefd580b05
SHA1

aabfde9fa7910ff59d6a2fd4de8f2280e4554695
SHA256

eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34
SHA512

df27c242f07c2ba0c8b2f526a189b3ba9fea78c75aa63da57f982c5d6a55ba73ba2e934f9f0ccbff68c9cb2795810f2d5f6b9f4bd6b87da4007f592512df77f7
SSDEEP

3072:tRFhJsebNVlW1NWgxLJOp6iJRejPoQKvHIbuduaqyuhjDxSIVbOfprMIYsMMgC6U:tRF3VoweHW0u8TDB4ty3huYu

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2480	2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
File opened for modification	C:\Windows\win.ini	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2480	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2480	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2480	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2480	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
2480	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2480	2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe	31
PID 2896 wrote to memory of 2480	2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe	31
PID 2896 wrote to memory of 2480	2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe	31
PID 2896 wrote to memory of 2480	2896	eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe	31

C:\Users\Admin\AppData\Local\Temp\eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
"C:\Users\Admin\AppData\Local\Temp\eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe
  "C:\Users\Admin\AppData\Local\Temp\eb5bcadcc3f76a63527061c741dbc47b3a538cef9a46b8d0feb502eae64b6f34.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\nas0.exe
    "C:\Users\Admin\AppData\Local\Temp\nas0.exe"
    3⤵
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\nas0.exe
      "C:\Users\Admin\AppData\Local\Temp\nas0.exe"
      4⤵
      PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nas0.exe

Filesize
368KB

MD5
55d309908ea8c683ae94e9c2a9c03df3

SHA1
ff990b1d1c5c1cb679dcc3d7a4217022def7c7a1

SHA256
fda4908eb13f6539b8c4eb000792de7f2cc6069c1edd7d68fdd39d41587792ad

SHA512
a45c32791980ead77f8cf1dce5a489d1f74309183eafb59305e050e2f9fb0ecd0f7ff82dae9370790348354ae3fc3ae6f4d7f4cd28633183a74908f5262d3634

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/2480-21-0x0000000000300000-0x0000000000305000-memory.dmp

Filesize
20KB

Download
memory/2896-4-0x0000000077531000-0x0000000077632000-memory.dmp

Filesize
1.0MB

Download
memory/2896-3-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download
memory/2896-5-0x0000000077530000-0x00000000776D9000-memory.dmp

Filesize
1.7MB

Download
memory/2896-13-0x0000000077720000-0x00000000777F6000-memory.dmp

Filesize
856KB

Download
memory/2896-12-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing