Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
6ce4cbcc4370011b8a5efe2b4fa02be4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6ce4cbcc4370011b8a5efe2b4fa02be4.exe
Resource
win10v2004-20240709-en
General
-
Target
6ce4cbcc4370011b8a5efe2b4fa02be4.exe
-
Size
984KB
-
MD5
6ce4cbcc4370011b8a5efe2b4fa02be4
-
SHA1
0be23e20e9799864c90f9a9fd62bf3eab51ebcbe
-
SHA256
543e130ed81ebf5b59b928cad7d70c161386789a6856d19d90399d2712d6b629
-
SHA512
f54b525894eb9360b55d3da561b7dba3ba1b94d71aa3939992c672320c068230e5b1d2799072d74e5f579b19a43e19811f4349d56fea8bc12f7b7143b1203b77
-
SSDEEP
24576:Igh3EFrduBatrzlkhrvyIlbuan230quO7yFDN7F:IA34YonulvyIf2BpGF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ce4cbcc4370011b8a5efe2b4fa02be4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe Token: SeSecurityPrivilege 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe Token: SeSecurityPrivilege 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2360 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe 30 PID 1484 wrote to memory of 2360 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe 30 PID 1484 wrote to memory of 2360 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe 30 PID 1484 wrote to memory of 2360 1484 6ce4cbcc4370011b8a5efe2b4fa02be4.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ce4cbcc4370011b8a5efe2b4fa02be4.exe"C:\Users\Admin\AppData\Local\Temp\6ce4cbcc4370011b8a5efe2b4fa02be4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5682⤵
- System Location Discovery: System Language Discovery
PID:2360
-