Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 07:37
General
-
Target
b7b91b1d6d9b75786136635dfadf9bbeea04f8e341fd54db0714ac1eca135495.exe
-
Size
409KB
-
MD5
031c4719496e92c0d58eafc606e56092
-
SHA1
16f8b3f7e1e83bba669f447acef0daaabd88d466
-
SHA256
b7b91b1d6d9b75786136635dfadf9bbeea04f8e341fd54db0714ac1eca135495
-
SHA512
ff4d3b2dbadd5f4768c25b3ad1a5a5d3a9ebcb4a307e767d36582610105f86256fd3d9e3c093636bdd303502de212e2c80cbf20f6dcd30f71894fddcd51f5b49
-
SSDEEP
6144:sZaWqZXus8PTmNzJeEkLB+4lx8i5I9yOE3u/lFWY+ggOcyq1phtfT1llEnx:sgisR9kN+Ix8F9yt+/OY4RflEx
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7b91b1d6d9b75786136635dfadf9bbeea04f8e341fd54db0714ac1eca135495.exe"C:\Users\Admin\AppData\Local\Temp\b7b91b1d6d9b75786136635dfadf9bbeea04f8e341fd54db0714ac1eca135495.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB