7319656b4c5c0f3c42526657e96c0732322806d7824e992baa4b816a525aae98

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Botnets PACK/Botnets PACK/Amadey Cracked/xpti/svg.exe
Size

2.5MB
MD5

3168a31552404661098af0156860f0c0
SHA1

9c10beb703314d0c8843ba7a3c988f793d55e422
SHA256

2a0546c07c3831073b3b1b83866c63150d56638358e20d8a5247417de1efa4ff
SHA512

3a3c93f4ccf441c7b86d2aae33ba636c975fb38ce14c62653f2c4606312a1259aba21d11a44ad5164d36fbc6ad136e12f9158971c26866568582111b95a98f6c
SSDEEP

49152:p7inIOY/BoiU2oyNiAbnblJwSinj+BxpEiixfXuwlp:ATF0LDjwSkgxeXv

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2084	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svg.exe

C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Amadey Cracked\xpti\svg.exe
"C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Amadey Cracked\xpti\svg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 804
  2⤵
  - Program crash
  PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2084 -ip 2084
1⤵
PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x00000000751DE000-0x00000000751DF000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x00000000007E0000-0x0000000000A64000-memory.dmp

Filesize
2.5MB

Download