Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 20:19
Behavioral task
behavioral1
Sample
c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe
Resource
win7-20240704-en
General
-
Target
c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe
-
Size
15.1MB
-
MD5
f922b9114e8db963e4bacd1aa3786b73
-
SHA1
e4d52183700fc9f08e9715d4da311f5ab75eaea5
-
SHA256
c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69
-
SHA512
c93e245b7d7afd3123b4c533dab41ef6d9d13896ccbc5a3e71a9722410a6342e2851a886b569a649ca0b59960795cdf8c2fc0779f2a0df2447b8b07f9bffaf7c
-
SSDEEP
393216:QWPBFpnQWbmFO0nwOqst0AkjMgD0Gt2DitqGJxKVh3OcrsN5S:bdfbH0nwCg3P2utqGY3OcwN5S
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1412-68-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-66-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-62-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-60-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-56-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-54-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-52-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1412-40-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral1/memory/1412-83-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-39-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-86-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-87-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-88-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-89-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-90-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-91-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-92-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-93-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-94-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-95-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-96-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-97-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-98-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-99-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-100-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-101-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-103-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-104-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-105-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-106-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-107-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-108-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-109-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect behavioral1/memory/1412-110-0x0000000000400000-0x0000000001D5C000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1412 c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe 1412 c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1412 c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe 1412 c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe 1412 c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe"C:\Users\Admin\AppData\Local\Temp\c19c5b41bbe725e4e6425b88bc89f711299347c2e2c0ae4fd68803b283737f69.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412