Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 06:34
Behavioral task
behavioral1
Sample
715d0f66d1da6354501cbce1ddafcf70N.exe
Resource
win7-20240705-en
General
-
Target
715d0f66d1da6354501cbce1ddafcf70N.exe
-
Size
316KB
-
MD5
715d0f66d1da6354501cbce1ddafcf70
-
SHA1
658f00a0cb19661cccc6b4992400d7d8d1bcef1e
-
SHA256
99bfebce7806c08da91d12f048c22e73bd22f565110b1ca335d067fcb2e5c285
-
SHA512
c4bef50c11f8431e8c921f76fe032ca28bd988b120245bd84cd53563e569341c391ef1d78307a2d2ac752f6434e8d3880a75ab30b58ccdee9040b0c58761b600
-
SSDEEP
1536:34d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZUnOHBRzU:3IdseIO+EZEyFjEOFqTiQmKnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2152-1-0x0000000000400000-0x000000000044F000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2104 2152 WerFault.exe 715d0f66d1da6354501cbce1ddafcf70N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
715d0f66d1da6354501cbce1ddafcf70N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 715d0f66d1da6354501cbce1ddafcf70N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
715d0f66d1da6354501cbce1ddafcf70N.exedescription pid process target process PID 2152 wrote to memory of 2104 2152 715d0f66d1da6354501cbce1ddafcf70N.exe WerFault.exe PID 2152 wrote to memory of 2104 2152 715d0f66d1da6354501cbce1ddafcf70N.exe WerFault.exe PID 2152 wrote to memory of 2104 2152 715d0f66d1da6354501cbce1ddafcf70N.exe WerFault.exe PID 2152 wrote to memory of 2104 2152 715d0f66d1da6354501cbce1ddafcf70N.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\715d0f66d1da6354501cbce1ddafcf70N.exe"C:\Users\Admin\AppData\Local\Temp\715d0f66d1da6354501cbce1ddafcf70N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 362⤵
- Program crash
PID:2104
-