Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 12:20
Behavioral task
behavioral1
Sample
1bb8d7c42abda98808783f4df421f680N.exe
Resource
win7-20240704-en
General
-
Target
1bb8d7c42abda98808783f4df421f680N.exe
-
Size
316KB
-
MD5
1bb8d7c42abda98808783f4df421f680
-
SHA1
5a2c4468dcb5b17cda4ac3a25e5f61a147030754
-
SHA256
1aa0fb7dc3eb0ec69ba1dffd4b881e8e3aeb66ddc28589820c3ab7dd513a85e2
-
SHA512
5eb4984d08677d388977464c24474d8c1d6cff64b25520f906e65df89a27cc2c6103b4448db3f1be120f3f7ba44648da98b99c896f202731514e9c490464ae87
-
SSDEEP
1536:F4d9dseIOc+93bIvYvZEyF4EEOF6N4yS+AQmZUnOHBRzU:FIdseIO+EZEyFjEOFqTiQmKnOHjzU
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2800-1-0x0000000000400000-0x000000000044F000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2040 2800 WerFault.exe 1bb8d7c42abda98808783f4df421f680N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1bb8d7c42abda98808783f4df421f680N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bb8d7c42abda98808783f4df421f680N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1bb8d7c42abda98808783f4df421f680N.exedescription pid process target process PID 2800 wrote to memory of 2040 2800 1bb8d7c42abda98808783f4df421f680N.exe WerFault.exe PID 2800 wrote to memory of 2040 2800 1bb8d7c42abda98808783f4df421f680N.exe WerFault.exe PID 2800 wrote to memory of 2040 2800 1bb8d7c42abda98808783f4df421f680N.exe WerFault.exe PID 2800 wrote to memory of 2040 2800 1bb8d7c42abda98808783f4df421f680N.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bb8d7c42abda98808783f4df421f680N.exe"C:\Users\Admin\AppData\Local\Temp\1bb8d7c42abda98808783f4df421f680N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 362⤵
- Program crash
PID:2040
-