Resubmissions
31-07-2024 15:05
240731-sf8zxazbjq 831-07-2024 15:04
240731-sft6ratgma 331-07-2024 15:04
240731-sfmrnszarm 331-07-2024 15:03
240731-se18nstgjb 331-07-2024 14:51
240731-r8c79syfll 831-07-2024 14:46
240731-r5qn7ayejj 331-07-2024 13:39
240731-qx27kszhpc 10Analysis
-
max time kernel
101s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 15:04
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20240730-en
General
-
Target
Installer.exe
-
Size
1.1MB
-
MD5
9819a03ffd0525dc2c67095ed032ee48
-
SHA1
4d39fce7df80e6d8ed1d07670a614879dcf15695
-
SHA256
74f36ce2089cea27236550f53c879258e279615c9815f905776fef84f4c4db81
-
SHA512
336244a436c8f1a169f5a58c8c8e22f07a9fe877736b0d60781667fbe8e82ac8c72859dd0d096e2eb290fd10065af1ece22d80e778a363de924f55de32aa3966
-
SSDEEP
24576:aw2nkacAuv0EkqjVnlqud+/2P+AlYOnet:aRnkr7nkqXfd+/9AlFne
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Installer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Installer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Installer.exepid process 1184 Installer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Installer.exedescription pid process Token: SeDebugPrivilege 1184 Installer.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-0-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/1184-1-0x0000000000930000-0x0000000000A42000-memory.dmpFilesize
1.1MB
-
memory/1184-2-0x0000000005C30000-0x00000000061D4000-memory.dmpFilesize
5.6MB
-
memory/1184-3-0x00000000054B0000-0x0000000005542000-memory.dmpFilesize
584KB
-
memory/1184-5-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB
-
memory/1184-4-0x0000000005680000-0x0000000005732000-memory.dmpFilesize
712KB
-
memory/1184-6-0x0000000006A50000-0x0000000006A72000-memory.dmpFilesize
136KB
-
memory/1184-7-0x0000000006BB0000-0x0000000006BBA000-memory.dmpFilesize
40KB
-
memory/1184-8-0x00000000744DE000-0x00000000744DF000-memory.dmpFilesize
4KB
-
memory/1184-9-0x00000000744D0000-0x0000000074C80000-memory.dmpFilesize
7.7MB