Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 11:30
Behavioral task
behavioral1
Sample
aca30f0a88c349b6b152ab8fd548f650N.exe
Resource
win7-20240729-en
General
-
Target
aca30f0a88c349b6b152ab8fd548f650N.exe
-
Size
316KB
-
MD5
aca30f0a88c349b6b152ab8fd548f650
-
SHA1
fc437ea62b50c11292b250e13a355e54849eb165
-
SHA256
91fe3c2cbcbb9d2e2b46651975e99798f68f0c298c291c0def2f59b36b0e8630
-
SHA512
247758893c59895b8ebf0fe392c372a5bb1a6a8ebe3ba53390b46073734f150e88d94180266404d0d8d0dae69f8ac01ced5b0487bb1294cc36a06aea59b5a156
-
SSDEEP
1536:J4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZUnOHBRzU:JIdseIO+EZEyFjEOFqTiQmKnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1916-1-0x0000000000400000-0x000000000044F000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2916 1916 WerFault.exe aca30f0a88c349b6b152ab8fd548f650N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
aca30f0a88c349b6b152ab8fd548f650N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aca30f0a88c349b6b152ab8fd548f650N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
aca30f0a88c349b6b152ab8fd548f650N.exedescription pid process target process PID 1916 wrote to memory of 2916 1916 aca30f0a88c349b6b152ab8fd548f650N.exe WerFault.exe PID 1916 wrote to memory of 2916 1916 aca30f0a88c349b6b152ab8fd548f650N.exe WerFault.exe PID 1916 wrote to memory of 2916 1916 aca30f0a88c349b6b152ab8fd548f650N.exe WerFault.exe PID 1916 wrote to memory of 2916 1916 aca30f0a88c349b6b152ab8fd548f650N.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aca30f0a88c349b6b152ab8fd548f650N.exe"C:\Users\Admin\AppData\Local\Temp\aca30f0a88c349b6b152ab8fd548f650N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 362⤵
- Program crash
PID:2916
-