Analysis
-
max time kernel
93s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 10:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Odeme Eylul.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Odeme Eylul.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Odeme Eylul.exe
-
Size
349KB
-
MD5
9202eafd948a7c76d895cf64a4c29266
-
SHA1
01cf5b9553d08d8255f2e125e9a6272e8b40b7a7
-
SHA256
90174afec8bf53b5718abdb2495257926f083cec0d4b90f7d2f7dda29ccbe256
-
SHA512
47e7bb6b613c8f1c358108c7e1447b950109fb6fb0dbf5cadc457f628ad5bdce5874da1ca9fc8a51432c79798c03d869189145725d688500ff009f826a839512
-
SSDEEP
6144:QocMkAI/pFPeX8yP2jYddBTnETaxzO7KIU4ctjccYnaXYI:JkAEFeXZP2jgTwTFa4ctjccYnaXF
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3008 set thread context of 4248 3008 Odeme Eylul.exe 86 PID 3008 set thread context of 1152 3008 Odeme Eylul.exe 87 -
Program crash 2 IoCs
pid pid_target Process procid_target 1040 4248 WerFault.exe 86 2740 1152 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odeme Eylul.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3008 Odeme Eylul.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 4248 3008 Odeme Eylul.exe 86 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87 PID 3008 wrote to memory of 1152 3008 Odeme Eylul.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"2⤵PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 803⤵
- Program crash
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"C:\Users\Admin\AppData\Local\Temp\Odeme Eylul.exe"2⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 803⤵
- Program crash
PID:2740
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4248 -ip 42481⤵PID:3220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1152 -ip 11521⤵PID:2240