Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe
Resource
win10v2004-20240802-en
General
-
Target
8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe
-
Size
968KB
-
MD5
fce908c3d656198dce6bafb77f0b9638
-
SHA1
0952a34cffd6ab444ed21889e0fa5eac6019ac5a
-
SHA256
8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba
-
SHA512
7796c6ba87d4d03d0a88e9ec1e71fe63c43fefaf2849f432413e5ab7763d087785661ba603026df0ea90db4bae770827a78f3694fb5071408016fa39acd94c7a
-
SSDEEP
12288:2d0NXLNiM0oqUO2rMQvQtcRyzCKBCDZvtcVRUyDWrwye9UIZq6UrN5GMAYr2ao0q:nbNiMN17rMtcoa22yDWrwye9XZq641o
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2884 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 30 PID 1964 wrote to memory of 2884 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 30 PID 1964 wrote to memory of 2884 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 30 PID 1964 wrote to memory of 2884 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 30 PID 1964 wrote to memory of 2764 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 31 PID 1964 wrote to memory of 2764 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 31 PID 1964 wrote to memory of 2764 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 31 PID 1964 wrote to memory of 2764 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 31 PID 1964 wrote to memory of 2652 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 32 PID 1964 wrote to memory of 2652 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 32 PID 1964 wrote to memory of 2652 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 32 PID 1964 wrote to memory of 2652 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 32 PID 1964 wrote to memory of 2776 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 33 PID 1964 wrote to memory of 2776 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 33 PID 1964 wrote to memory of 2776 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 33 PID 1964 wrote to memory of 2776 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 33 PID 1964 wrote to memory of 2712 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 34 PID 1964 wrote to memory of 2712 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 34 PID 1964 wrote to memory of 2712 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 34 PID 1964 wrote to memory of 2712 1964 8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"2⤵PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"2⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"2⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"2⤵PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"C:\Users\Admin\AppData\Local\Temp\8b4d43e5b2ff9fe2d915daa5c884832dd0635b231274236bfa4863d0220d4eba.exe"2⤵PID:2712
-