Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 21:26

General

  • Target

    5c101927aee501810c201879f0e9beb541a9be0403bd1e071b0daf0b94495beb.exe

  • Size

    3.6MB

  • MD5

    fe75b8b1b06834a5833fca612dd7735e

  • SHA1

    1d70f832046fbb2f689b856f62ad844b29715b32

  • SHA256

    5c101927aee501810c201879f0e9beb541a9be0403bd1e071b0daf0b94495beb

  • SHA512

    2f7138d74f741a1d51abbb844f8d5a1974b17b7e31cc5e3bb71e05227f7af96deb6aea5b182fda00528cc2ebb589ac6ac73bc8646807e521caeabc6cbdcaa00e

  • SSDEEP

    98304:4/o8B/WB4mv4DiUFKDGn1NvIAhq852jJeksKN0L/2tzv:MfI46JUF9n1NAA9MjJeksk0Cv

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c101927aee501810c201879f0e9beb541a9be0403bd1e071b0daf0b94495beb.exe
    "C:\Users\Admin\AppData\Local\Temp\5c101927aee501810c201879f0e9beb541a9be0403bd1e071b0daf0b94495beb.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:4120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4120-0-0x0000000000400000-0x00000000007C6000-memory.dmp

    Filesize

    3.8MB

  • memory/4120-1-0x0000000000400000-0x00000000007C6000-memory.dmp

    Filesize

    3.8MB

  • memory/4120-2-0x0000000002850000-0x0000000002BA6000-memory.dmp

    Filesize

    3.3MB

  • memory/4120-4-0x0000000002850000-0x0000000002BA6000-memory.dmp

    Filesize

    3.3MB

  • memory/4120-3-0x0000000002850000-0x0000000002BA6000-memory.dmp

    Filesize

    3.3MB

  • memory/4120-5-0x0000000002850000-0x0000000002BA6000-memory.dmp

    Filesize

    3.3MB

  • memory/4120-6-0x0000000000400000-0x00000000007C6000-memory.dmp

    Filesize

    3.8MB

  • memory/4120-7-0x0000000002850000-0x0000000002BA6000-memory.dmp

    Filesize

    3.3MB