Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95.exe
Resource
win7-20240705-en
2 signatures
150 seconds
General
-
Target
b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95.exe
-
Size
415KB
-
MD5
42c2ecba382ca7b7f5ae6fe76f2c8569
-
SHA1
da4f435ad23ca386604809dc9467330a39e2af23
-
SHA256
b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95
-
SHA512
ce18c1d90f6121096286b8c2605a22e2bb70c21cafbad967122bcb100d699d6a47b902e1927a45fbb96c8143af29c74e42313c4edecaeaf8bd435233d19f6aa5
-
SSDEEP
12288:WrKyKsimU291v+w04As8mzJB93sBNCG9n:WrKyKsiB0B+w04/Ujn
Malware Config
Signatures
-
Expiro payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5036-0-0x000000000093B000-0x00000000009CE000-memory.dmp family_expiro1 behavioral2/memory/5036-1-0x00000000008D0000-0x00000000009CE000-memory.dmp family_expiro1 behavioral2/memory/5036-3-0x000000000093B000-0x00000000009CE000-memory.dmp family_expiro1 behavioral2/memory/5036-2-0x00000000008D0000-0x00000000009CE000-memory.dmp family_expiro1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b64e2ed624b7d878d680265e2cb5bb0f824dea5e7decc7677b8ed5c06e6e8d95.exe