ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab

General

Target

ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
Size

372KB
MD5

9ddc44a5c178dd4373d2783205f5bb7e
SHA1

fdc28a7ba32079ac97117794960c3e73a8e1bc80
SHA256

ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab
SHA512

1708cc48e42d6d1f6abbdb8bc904aa4df35d1968116806f2e375ba0e77a7e9c5cf0709a4c5b897a5bd0ecd3bf781720edd6323926e67198858349862bcad6bab
SSDEEP

6144:t8dgUkQx+HXGidCzj8LBb8Rw5Jdypyf6aCXYfhiC+:t2qQx+H2i+8LBNbdypazCXY0

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 2304	3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
File opened for modification	C:\Windows\win.ini	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
2304	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
2304	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
2304	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
2304	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
2304	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2304	3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe	30
PID 3064 wrote to memory of 2304	3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe	30
PID 3064 wrote to memory of 2304	3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe	30
PID 3064 wrote to memory of 2304	3064	ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe	30

C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
"C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe
  "C:\Users\Admin\AppData\Local\Temp\ed85b2c5087e8b1b36ce0ae7c3c7532ce415fe626069774af7007b40443df0ab.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\hab.exe
    "C:\Users\Admin\AppData\Local\Temp\hab.exe"
    3⤵
    PID:532
  - - C:\Users\Admin\AppData\Local\Temp\hab.exe
      "C:\Users\Admin\AppData\Local\Temp\hab.exe"
      4⤵
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hab.exe

Filesize
372KB

MD5
b749861c61359bfb05276610b11a95a8

SHA1
e7fbc55f75c67cdfc1b650810abd9c04ef830f88

SHA256
8d6a17ea27483139cd8bb69361f980d8368c8ba7cc075542ca299d0ee13ad44a

SHA512
eb63827587c7b691a619108700ceebd7fde7f4e47bbd1742e565e0c1bf8bb68f2d1e6066adfe8c2aa013fec8e3863a9444144b60328302f6bdd741abf87f0e3f

Download Submit
C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/2304-20-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3064-3-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3064-5-0x0000000076EB0000-0x0000000077059000-memory.dmp

Filesize
1.7MB

Download
memory/3064-4-0x0000000076EB1000-0x0000000076FB2000-memory.dmp

Filesize
1.0MB

Download
memory/3064-12-0x00000000770A0000-0x0000000077176000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing