Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2024 15:34
Static task
static1
Behavioral task
behavioral1
Sample
1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
_________________________________________________________________1104XDXD8913IDGC.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
_________________________________________________________________1104XDXD8913IDGC.dll
Resource
win10v2004-20231215-en
General
-
Target
1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe
-
Size
120.8MB
-
MD5
151873c242dfeef9e5beece8f32e7784
-
SHA1
9b2cdbfeedd53f99027c350d09f9749647eccf22
-
SHA256
daa04dde555bc566c2862bdbdf17c49b11fe09d146ccf258c38155ff0dbad6cd
-
SHA512
f342303cfe2dfe7562d0cf3e07c86cf8d98829f665fb5cc3a5797c53c27965694c9bb55c25a1047d0d2fb70e1d42298401cdc8cc02573479dd2445499ed59149
-
SSDEEP
49152:mONcPv1xujx+aRpH9y8CNyY+IYDEJ+SkLl3PHR0H4PfgHbBT1W72bqvDw8VF/3Iw:mvsvZvPfyBT87Xv1F3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4804 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe 4804 1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe"C:\Users\Admin\AppData\Local\Temp\1454 Factura AFIP - RFC Emisor YLHN2585 - Situacion Fiscal BPUA5150 Ref-UHFU8588.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4804