1d1250b78aafcd3f5c0e9784c164e5deb8a67e68604dc502803f7656d4b68f00

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/rkverify.exe
Size

368KB
MD5

7ce09413d7e39a8d984d29b032499a68
SHA1

23b404b6d460c57572e277883527a7af053dd7d2
SHA256

7d9967027f313bdc045565d408fd278600d2f59557ef943b1dedd65a2bc2c320
SHA512

27d75e7b62310c0203b71a57d296798a5201d3b7ead5fa946073a328ace9174f66f540069587ea982d84dd603f5181b98ca6ace1df654c8f6068dc520cc7dab2
SSDEEP

6144:80Qrfc/0PXVVw0uHfQEVjwYcvsbkxbUSicNtUmUTBqwNtolgFV4/PxxCNlMW8:80QY8PXTwz7w+kWcNqmUTsw0l6u/P2N2

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2460	rkverify.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rkverify.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2460	rkverify.exe
2460	rkverify.exe
2460	rkverify.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\rkverify.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\rkverify.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2460

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CSMEA8E.tmp

Filesize
200KB

MD5
c760be13a9328aaa3e75075b86520546

SHA1
e23459a7ce698ef9421147964d33c49323f5bc28

SHA256
1f63e66d08225a0f775c13cbb052d7cba0f19fb760767973e8bf7eb4152a18fd

SHA512
54ad187e54416a9d8cbf385b4f37723c513a960bb0c73f685c8c454eafc2b0f8e75adb060f65cf4d166236a756ddf735a78a6dba22096a2a59e26e6fe58265b7

Download Submit