Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 00:48
Behavioral task
behavioral1
Sample
7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe
Resource
win7-20240729-en
General
-
Target
7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe
-
Size
316KB
-
MD5
7e5d54619f5f99d5ccb3cfa51e1b6da0
-
SHA1
dc9c1518246f0b8d918d070f6d2cfd897a2447e0
-
SHA256
f4a96017c9d48a136133b44b8ed0b752cecc70c4ad1e851e8c282d737a24c9a0
-
SHA512
e6defacfd8291e1a63278bebd5993427a005752db02eb420705cf273b6799fce74a208bb3b7855bd3e268dab7c2b675d2dc6ec717cf41bc5b718a5745cce6285
-
SSDEEP
1536:B4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZUnOHBRzU:BIdseIO+EZEyFjEOFqTiQmKnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2488-1-0x0000000000400000-0x000000000044F000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3052 2488 WerFault.exe 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7e5d54619f5f99d5ccb3cfa51e1b6da0N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7e5d54619f5f99d5ccb3cfa51e1b6da0N.exedescription pid process target process PID 2488 wrote to memory of 3052 2488 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe WerFault.exe PID 2488 wrote to memory of 3052 2488 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe WerFault.exe PID 2488 wrote to memory of 3052 2488 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe WerFault.exe PID 2488 wrote to memory of 3052 2488 7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe"C:\Users\Admin\AppData\Local\Temp\7e5d54619f5f99d5ccb3cfa51e1b6da0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 362⤵
- Program crash
PID:3052
-