Resubmissions
23/08/2024, 01:55
240823-ccb8rszamd 3Analysis
-
max time kernel
1799s -
max time network
1158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
client/main.bat
Resource
win7-20240705-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
client/main.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
1800 seconds
Behavioral task
behavioral3
Sample
client/winvnc.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral4
Sample
client/winvnc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
1800 seconds
General
-
Target
client/winvnc.exe
-
Size
2.4MB
-
MD5
91e16ed34a313ad3202fff563c07e89b
-
SHA1
c26641204fd3a96164bf5c195ef3de95906de7de
-
SHA256
b22f88b0f0053e2e260070bcd762ea8d7b8507633ace9be1df902975f6d7aff1
-
SHA512
8742ad30db1ec489b60aa23c2bb321114533d395e34a0e2e7580fa832554092fbaf32d250dedde96fd272bd5d9e9fe974239c85b94a8842171ef4e95dd4741d3
-
SSDEEP
49152:r0uJWMVUzMtBxV2wb8UOA0nCChZ1OhNTHXQguAUA/JsSe:YyWtgtVbb8UOA0/hZ1yYp
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winvnc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe 3900 winvnc.exe