Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10-08-2024 13:46
General
-
Target
add0678c73a8c47bbbb60d077a07b7b166b94b0370bde29140f3aa678699fa4f.exe
-
Size
418KB
-
MD5
215cccc15f1212f1098336da116dd7c4
-
SHA1
5bc17304252ddc46f5b1ca67b18750c60f2b8b4f
-
SHA256
add0678c73a8c47bbbb60d077a07b7b166b94b0370bde29140f3aa678699fa4f
-
SHA512
bed956a0b4930c09c89dce688b18ddbadbd1bfa9c84d521a09a369ebe65795b7909b873db31ffc1307e019d3219620bce247ec064ac4d5877b44272f988de215
-
SSDEEP
12288:DBqhAIS8IGYrTqENMTQjOKFdx/M39d6S:tqhcNprY1Katd
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\add0678c73a8c47bbbb60d077a07b7b166b94b0370bde29140f3aa678699fa4f.exe"C:\Users\Admin\AppData\Local\Temp\add0678c73a8c47bbbb60d077a07b7b166b94b0370bde29140f3aa678699fa4f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB