ef1b6659c135d37a9e43aeafc5e5df5d78320cf1630d3121028df2ea48befb0d

Analysis

max time kernel
19s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2025, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malwares/ClientUpdate.exe (x86).exe
Size 324KB
Sample250618-ehc4csaj2t
SHA256 2fc39463b6db44873c9c07724ac28b63cdd72f5863a4a7064883e3afdd141f8d
MD5 33f98b613b331b49e272512274669844
SHA1 cc99395963de6da81dac96929a8e234c8415714a
SHA512 3b3bd4dfe58422a6bc798fbfc591cb75e947f6fe51aa30d102a8bb792d862e52813f37cb0c940a2a9cfd0066f021afedb6bc8ac73d397b39fec63de7416fb065
SSDEEP 6144:7Udgoiru/R7V55fTHVj12xgdVVsN1l7GGEULXyIl67TRoEY6cAOehFWucwOTM:7ciS/R7VDfR9dkt9EKAR1+EILtTM
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2644	sc.exe
6112	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	6040	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClientUpdate.exe (x86).exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 6140	6040	ClientUpdate.exe (x86).exe	87
PID 6040 wrote to memory of 6140	6040	ClientUpdate.exe (x86).exe	87
PID 6040 wrote to memory of 6140	6040	ClientUpdate.exe (x86).exe	87
PID 6140 wrote to memory of 6112	6140	cmd.exe	89
PID 6140 wrote to memory of 6112	6140	cmd.exe	89
PID 6140 wrote to memory of 6112	6140	cmd.exe	89
PID 6040 wrote to memory of 1916	6040	ClientUpdate.exe (x86).exe	90
PID 6040 wrote to memory of 1916	6040	ClientUpdate.exe (x86).exe	90
PID 6040 wrote to memory of 1916	6040	ClientUpdate.exe (x86).exe	90
PID 1916 wrote to memory of 2644	1916	cmd.exe	92
PID 1916 wrote to memory of 2644	1916	cmd.exe	92
PID 1916 wrote to memory of 2644	1916	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Malwares\ClientUpdate.exe (x86).exe
"C:\Users\Admin\AppData\Local\Temp\Malwares\ClientUpdate.exe (x86).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6040
- C:\windows\SysWOW64\cmd.exe
  /u /c sc create soydsk type= kernel start= demand binPath= "C:\Users\Admin\AppData\Local\Temp\Malwares\ClientUpdate.exe (x86).exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\SysWOW64\sc.exe
    sc create soydsk type= kernel start= demand binPath= "C:\Users\Admin\AppData\Local\Temp\Malwares\ClientUpdate.exe (x86).exe
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6112
- C:\windows\SysWOW64\cmd.exe
  /u /c sc start soydsk
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\sc.exe
    sc start soydsk
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 280
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6040 -ip 6040
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads