Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 19:46
Behavioral task
behavioral1
Sample
x360ce.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
x360ce.exe
Resource
win10v2004-20240730-en
General
-
Target
x360ce.exe
-
Size
3.1MB
-
MD5
b6e5bd3c6abd734ac9d66f7dbcdb8409
-
SHA1
485e46c4dcf4d1274eae63932c024bdf9fc52e34
-
SHA256
28e424c515f3724c872fc1d5d79709fa9d13e7986c47fb678b90a677a225abf5
-
SHA512
2e825c315db6761af99385d6be13308bc0f111d024b8a0e9e22d806d54b8312c1864f08799b73ee7b441719fb81d57000cfc5ce7ddc118745ca41226858db67b
-
SSDEEP
49152:0NbfJJb4/WGdvbKJJb4/WGBJJb4/WGwJJb4/WGA0wr+jTZtaZ3Otfj7UCLiJJe4f:oXbbG5mbbGVbbGobbGABr+dCe6GC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
x360ce.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x360ce.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
x360ce.exepid process 3012 x360ce.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
x360ce.exepid process 3012 x360ce.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
x360ce.exepid process 3012 x360ce.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\X360CE\x360ce.Presets.xmlFilesize
182B
MD5f135ee37bdc2bee6bf638994e6a94f0b
SHA14760b3c9a1bc86f8b57891cedd01ba76a6552e8c
SHA2565a1e6a26433d1c1d5b72ecf67ca89dba3ef9a35192b23640911bbf232c21b458
SHA51294346c7cf89c39440635ce876cba9b56571f7c40372a13717b565d202258586714932a3fcafdd6bbf64b91cc4a924b686de3ab9c2f53afcd6b77e801c1f1d785
-
C:\Users\Admin\AppData\Local\Temp\xinput_Amd64.tmp.dllFilesize
123KB
MD55236623449893c0e1e98fc95f067fcff
SHA150b4f1e2340b7c7ad065b2111fc075b2cafe6231
SHA256301f0d831d95bb5c3b5c57f8a92a35211531b410fcf2bd08927a286b867142a3
SHA5129b94bddcb5e64bbf3649567f16a828588423873b60858d45c40155f36cc7f95d205f4e9b6cdc8ac2852240fdb6a67d0940c60e4f103cecbf118eae1438019c0c
-
memory/3012-18-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3012-21-0x00000000082E0000-0x0000000008300000-memory.dmpFilesize
128KB
-
memory/3012-4-0x0000000005490000-0x0000000005522000-memory.dmpFilesize
584KB
-
memory/3012-15-0x00000000061B0000-0x00000000061DC000-memory.dmpFilesize
176KB
-
memory/3012-16-0x0000000006420000-0x00000000064AE000-memory.dmpFilesize
568KB
-
memory/3012-17-0x00000000064C0000-0x0000000006504000-memory.dmpFilesize
272KB
-
memory/3012-0-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/3012-19-0x00000000076D0000-0x00000000076DA000-memory.dmpFilesize
40KB
-
memory/3012-20-0x0000000009E70000-0x000000000A24A000-memory.dmpFilesize
3.9MB
-
memory/3012-3-0x00000000053D0000-0x00000000053EA000-memory.dmpFilesize
104KB
-
memory/3012-22-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3012-23-0x000000000A250000-0x000000000A5A4000-memory.dmpFilesize
3.3MB
-
memory/3012-2-0x0000000005B50000-0x00000000060F4000-memory.dmpFilesize
5.6MB
-
memory/3012-1-0x0000000000730000-0x0000000000A44000-memory.dmpFilesize
3.1MB
-
memory/3012-43-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/3012-44-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3012-45-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB