67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242

General

Target

67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
Size

368KB
MD5

abb0be3069387cdf28e85e926d1448ff
SHA1

9d95ae26045a6d71d4d0967a998caf2a6d72eb19
SHA256

67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242
SHA512

d1eb4213ec72ca380180c66e388e6077d0e5945b6b33e7c816670a5661cde18bfa70a335dd7c2b2d79a8e0c16ba72c36015006553853116076993e4758ddfd1b
SSDEEP

3072:toFhJsebNVlW1NWgxLJOp6iJRejPoQKvHIbuduaqyuhjDxSIVbOfprMIYsMMgC6z:toF3VoweHW0u8TDB4ty3huDu

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 2400	2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
File opened for modification	C:\Windows\win.ini	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2400	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2400	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2400	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2400	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
2400	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2400	2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe	31
PID 2464 wrote to memory of 2400	2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe	31
PID 2464 wrote to memory of 2400	2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe	31
PID 2464 wrote to memory of 2400	2464	67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe	31

C:\Users\Admin\AppData\Local\Temp\67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
"C:\Users\Admin\AppData\Local\Temp\67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe
  "C:\Users\Admin\AppData\Local\Temp\67de97400d0f7575bdef20b790bc62ce4d17847c7e710d7b1036f12a7fbd9242.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\nas0.exe
    "C:\Users\Admin\AppData\Local\Temp\nas0.exe"
    3⤵
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\nas0.exe
      "C:\Users\Admin\AppData\Local\Temp\nas0.exe"
      4⤵
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
\Users\Admin\AppData\Local\Temp\nas0.exe

Filesize
368KB

MD5
0ab9918229315fe3b872c44b539c36e6

SHA1
b836a1daa1f723c1ce9f93ab066658803d1884e1

SHA256
e3d8fd68181312f73e24521f79a19fb5f806ffc3052fe889df7b87e03abb1291

SHA512
988cb32c9ec7bf6db19ab6872d8837d49b503ef0b99cb8c6f526b1942835645383cd5bd24e96ab613cddc6a65bc9e12c274b52a88d245f02c612ef90b0974344

Download Submit
memory/2400-15-0x0000000076D80000-0x0000000076F29000-memory.dmp

Filesize
1.7MB

Download
memory/2464-2-0x00000000004A0000-0x00000000004A5000-memory.dmp

Filesize
20KB

Download
memory/2464-4-0x0000000076D81000-0x0000000076E82000-memory.dmp

Filesize
1.0MB

Download
memory/2464-5-0x0000000076D80000-0x0000000076F29000-memory.dmp

Filesize
1.7MB

Download
memory/2464-13-0x0000000076F70000-0x0000000077046000-memory.dmp

Filesize
856KB

Download
memory/2464-10-0x00000000004A0000-0x00000000004A5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing