e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd

Analysis

max time kernel
104s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
05/09/2025, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
Size 1.2MB
Sample250905-sbr6layms3
SHA256 e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd
MD5 ee5dbba0af854f6dcf875a1c0aa9cc46
SHA1 135116cc8866a16a6ab3e6c54b90b556281b88fd
SHA512 dfe9b4777a2e42bbe50f5403a780ee87eb968010eae51c1d7372b0f5d54122d47d70b54393122ea87e019b46eafb985806901196218879d28adff89170744856
SSDEEP 24576:e5EmXFtKaL4/oFe5T9yyXYfP1ijXdaGMoA32+MHpaHZz:ePVt/LZeJbInQRaGQOa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 5748	2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	79

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1404	5748	WerFault.exe	79
3500	2488	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 5748	2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	79
PID 2488 wrote to memory of 5748	2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	79
PID 2488 wrote to memory of 5748	2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	79
PID 2488 wrote to memory of 5748	2488	e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe	79

C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe
"C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\e33e0044cb8cab8031d12c9e4cd922d81efeb5276dd5898ee2ef8b9cbdf28ddd.exe"
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 204
    3⤵
    - Program crash
    PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 756
  2⤵
  - Program crash
  PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2488 -ip 2488
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5748 -ip 5748
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut6533.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut6533.tmp
Size 287KB
SHA256 e126ee02dfff66d8a7c6ac64b3be5c66992cf9e23bbcb9ad762916ecd850d5f5
MD5 4190f3bf760c6be02158ee20e12a85c6
SHA1 94fda4b1293e91bbcfb9bb37579db1cddf9009a5
SHA512 d2b33999032454deede5ef612af82ddfecc0eaf2f8aa2cb8e27832eaa8601204dbf0db04564014321d225fbfe4e364957e6d0be998032b5c727438b3e40b71f0
SSDEEP 6144:csmSWCd8WeQ9EZZkrC8L4JJ5+iHrdRmY8yavvj8dZMLhw3:czSWCWCEZICG4J+Yrjm98b3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2488-14-0x0000000000DD0000-0x00000000011D0000-memory.dmp

Download

memory/5748-15-0x0000000000360000-0x00000000003A8000-memory.dmp