Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 02:06
Static task
static1
Behavioral task
behavioral1
Sample
5fe5e2861f87eb45375de51856cbce7e7b56fb28f486372ee2c91356e4338f48.exe
Resource
win7-20240705-en
General
-
Target
5fe5e2861f87eb45375de51856cbce7e7b56fb28f486372ee2c91356e4338f48.exe
-
Size
415KB
-
MD5
fd629d89a49c0fa9376f08351676ace6
-
SHA1
1aeb12ac5aa2fad19f032fb780fa8c028c5f6ddd
-
SHA256
5fe5e2861f87eb45375de51856cbce7e7b56fb28f486372ee2c91356e4338f48
-
SHA512
988deecdb33e8b796de293e322f4876d2735d33f63974e94e00af3264a6670356c9b38ea44193f62319698ab7a0b43fdb449a9c8958a6fef44afc4e8f7eb8cc2
-
SSDEEP
6144:lrTyKsi3UfohWEGmNO2/hFJM9gRY+e2at8cxY7FwWKq5XsN:lrTyKsi3moJGmQK7JMZX8cxY7Fw/ys
Malware Config
Signatures
-
Expiro payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-0-0x00000000003BB000-0x000000000044E000-memory.dmp family_expiro1 behavioral2/memory/1560-1-0x0000000000350000-0x000000000044E000-memory.dmp family_expiro1 behavioral2/memory/1560-3-0x0000000000350000-0x000000000044E000-memory.dmp family_expiro1 behavioral2/memory/1560-2-0x00000000003BB000-0x000000000044E000-memory.dmp family_expiro1 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5fe5e2861f87eb45375de51856cbce7e7b56fb28f486372ee2c91356e4338f48.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fe5e2861f87eb45375de51856cbce7e7b56fb28f486372ee2c91356e4338f48.exe