Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 06:41
Static task
static1
Behavioral task
behavioral1
Sample
371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe
Resource
win7-20240705-en
General
-
Target
371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe
-
Size
417KB
-
MD5
d48829e0304a6d62d8dcd1be9c06d8f6
-
SHA1
c23f432b94796a9a266849e747e46a2f84b60b7d
-
SHA256
371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f
-
SHA512
20a66d25438509c8dd9bc1b769530bbb0f88b3460e08c99e1b9f8a362c55c5f6a1cdd63abff698954282205d33679906a7303d8c7bedb230bd05399cf4ad3e88
-
SSDEEP
6144:hSpwTEOzPSK5U2SoJ8VWackMV1ZmXRWLgKocUq8nOfaIROo71YvK09lw+45B:Q+IK5U2Soys3mwLQcUqgsPBYv745B
Malware Config
Signatures
-
Expiro payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/864-0-0x000000000104C000-0x00000000010DF000-memory.dmp family_expiro1 behavioral2/memory/864-1-0x0000000000FE0000-0x00000000010DF000-memory.dmp family_expiro1 behavioral2/memory/864-3-0x0000000000FE0000-0x00000000010DF000-memory.dmp family_expiro1 behavioral2/memory/864-2-0x000000000104C000-0x00000000010DF000-memory.dmp family_expiro1 -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 556 864 WerFault.exe 371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe"C:\Users\Admin\AppData\Local\Temp\371455235fb78b0f5bf933a52fc68155edd3df7d356ae1da4d74f72384b25c6f.exe"1⤵
- System Location Discovery: System Language Discovery
PID:864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 2522⤵
- Program crash
PID:556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 864 -ip 8641⤵PID:436