Overview
overview
7Static
static
7YENI_HILE_...SK.rar
windows7-x64
3YENI_HILE_...SK.rar
windows10-2004-x64
3YENİ HİL...v3.exe
windows7-x64
6YENİ HİL...v3.exe
windows10-2004-x64
6YENİ HİL...V3.dll
windows7-x64
3YENİ HİL...V3.dll
windows10-2004-x64
3YENİ HİL...hl.exe
windows7-x64
7YENİ HİL...hl.exe
windows10-2004-x64
7out.exe
windows7-x64
3out.exe
windows10-2004-x64
3YENİ HİL...v3.dll
windows7-x64
3YENİ HİL...v3.dll
windows10-2004-x64
3YENİ HİL...v3.ini
windows7-x64
1YENİ HİL...v3.ini
windows10-2004-x64
1YENİ HİL...hd.ini
windows7-x64
1YENİ HİL...hd.ini
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 15:39
Behavioral task
behavioral1
Sample
YENI_HILE_THE_MASK.rar
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
YENI_HILE_THE_MASK.rar
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
YENİ HİLE/Extreme Injector v3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
YENİ HİLE/Extreme Injector v3.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
YENİ HİLE/ZeroV3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
YENİ HİLE/ZeroV3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
YENİ HİLE/ZeroV3.hl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
YENİ HİLE/ZeroV3.hl.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
out.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
out.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
YENİ HİLE/Zerov3.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
YENİ HİLE/Zerov3.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
YENİ HİLE/Zerov3.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
YENİ HİLE/Zerov3.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
YENİ HİLE/injmthd.ini
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
YENİ HİLE/injmthd.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
YENİ HİLE/ZeroV3.hl.exe
-
Size
179KB
-
MD5
12b9674d5a68f829f20214644e67baa3
-
SHA1
9f2681173105f628c7cb14b57540121c5dc667dd
-
SHA256
88132922084d88a606d4430b1903c2c7d2b48e4b1467253c3a51ed00b05954c6
-
SHA512
c1c47d6d7f2ec3d2cf6a50fe85acab653a4e81d7c56a2f1972f7de0b686272c3cb03f59be9512acb4530b94bbe90d4b81b00682d4413ed62bc69b6033a43a073
-
SSDEEP
3072:O2qkbSLWyjCkRtc8lsAR8Z4GkZypFuX6HNwTBf0aeEus/aL:xH+ayW8fWOCDRY0ouAK
Malware Config
Signatures
-
resource yara_rule behavioral8/memory/4316-0-0x00000000001D0000-0x000000000022F000-memory.dmp upx behavioral8/memory/4316-2-0x00000000001D0000-0x000000000022F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZeroV3.hl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe 4316 ZeroV3.hl.exe