Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 09:35
Behavioral task
behavioral1
Sample
7dad2c4407957ac063b27b5dbbe8e596.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
General
-
Target
7dad2c4407957ac063b27b5dbbe8e596.exe
-
Size
4.9MB
-
MD5
7dad2c4407957ac063b27b5dbbe8e596
-
SHA1
9309ba525bd5486667017d84a15a94f18616c125
-
SHA256
eefe4186b76670dd5d2a0e69ff14d4833333cd4b047a3f2260a736fd69da4a79
-
SHA512
f7ee96644ca686dde3686cc7c920c2ce43b6d8e81458d3f24fa38cb1f33a04c079097caaa7847c4b00b25e6115c7ac619caa50a70840020103dc59ab96f9c2e6
-
SSDEEP
98304:cHq30uZ1rpxCcHiU7g/iftzaGS107AJ121Ghl8LcFRrgDn7LgckWofmgC/g:czuFxCSx7gKJS10UT2Cl8APsTV4fmPY
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1956-0-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-1-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-3-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-4-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-8-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-9-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-11-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-12-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-14-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx behavioral1/memory/1956-15-0x0000000000B20000-0x0000000001A2E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7dad2c4407957ac063b27b5dbbe8e596.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dad2c4407957ac063b27b5dbbe8e596.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7dad2c4407957ac063b27b5dbbe8e596.exepid process 1956 7dad2c4407957ac063b27b5dbbe8e596.exe 1956 7dad2c4407957ac063b27b5dbbe8e596.exe