Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe
Resource
win7-20240903-en
General
-
Target
bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe
-
Size
13.6MB
-
MD5
3da6c50ed714753a5e8d791742661bf3
-
SHA1
e0e938d6d12fc2d96709541d64bf4fcfd82d0b17
-
SHA256
bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb
-
SHA512
a82d844b137dc4b80bb4b377fccd073eaa4d6d66208f731b13237dbe0531fe86747f5058e45d193014cbcc5bcc185a7aab3f4cf182d668d536a8613e1bf16979
-
SSDEEP
393216:gpG9CZ3cyVGNEksGtnR4AM/ic9sHaJSRX7xD:g09kcakztnq/jqaJSRX
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0009000000017570-2.dat aspack_v212_v242 -
Loads dropped DLL 2 IoCs
pid Process 2236 bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe 2236 bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe"C:\Users\Admin\AppData\Local\Temp\bb17ac88ddf2c4f7dcaabc736c066fd23b683f7c010642bf98f7f7420d8c62eb.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD514a4d83af50c93b1e5049e299e2ae93e
SHA18d47d7fe0e7e289c0d1d1a778ff713e8b976160e
SHA256211bcaf4a5e850653e40a37d63f27479503d793053f801fd9d9a3238c463746b
SHA512f02828c3a03c316396b3a1036799b38ca6d764d4dad430a9460a7253ccad98cb9a4f4fc15a1ee1cbc80cf2105c6e104dda41d5455c7c2378c9dc71de17fe2727
-
Filesize
6.1MB
MD5d7beff9a0702ee3433e352920a158306
SHA1c659cd53a89b3ba8449b8040bc1b03f0fbafaeb6
SHA25612a3ecd17726e69fec15fca91d3e14cfe0657a3ee90bb3ff13ee10b4535b881f
SHA5127779d789056f345c2ca1a8f0dbbda860cedd64a8867255fa92786ab6a3789ff75acb771b2be75faa74408b5c9166e474f31424f0d34f1dccc59d5be9efcf65f1