Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 06:31
General
-
Target
80a7d9f8911acde1c5e1d382df836ead8ddbe12ed0f9615dbfe2257f19378331.exe
-
Size
409KB
-
MD5
21b98438bed61d5d29c7194bceec3a3d
-
SHA1
b42daa622d33ce10383338656f936c0a9223ca48
-
SHA256
80a7d9f8911acde1c5e1d382df836ead8ddbe12ed0f9615dbfe2257f19378331
-
SHA512
4da41c85d82ce876b203c6d2bc030fea8425c137511349f1f8d61f68d3face145993602b8989b71ec7f610e0cac4f95abe2ef2fc04d78e55252b2488da74a0e6
-
SSDEEP
6144:RZaWqZXus8PTmNzJeEkLB+4lx8i5I9yOE3u/lFWY+ggOcyq1phtfT1llEnx:RgisR9kN+Ix8F9yt+/OY4RflEx
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80a7d9f8911acde1c5e1d382df836ead8ddbe12ed0f9615dbfe2257f19378331.exe"C:\Users\Admin\AppData\Local\Temp\80a7d9f8911acde1c5e1d382df836ead8ddbe12ed0f9615dbfe2257f19378331.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB