Analysis
-
max time kernel
92s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 10:52
Static task
static1
Behavioral task
behavioral1
Sample
48-383177B7595-1908183718438I46673-Abrechnung.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48-383177B7595-1908183718438I46673-Abrechnung.exe
Resource
win10v2004-20240802-en
General
-
Target
48-383177B7595-1908183718438I46673-Abrechnung.exe
-
Size
655KB
-
MD5
0807e2b271d291cdfcb2c60e9694c300
-
SHA1
aa0d2a123b62ca20b3914afaac9208672d302b99
-
SHA256
eb32ca2e66b8609e42c44e30a5d0cd729489ae1fe7eb6686749da4aacad441a1
-
SHA512
5ee1b5aa2576d0ee3e9204a3d2e4b875f071b6a6bd39f7f692fe62a0851c1f15545601f8ad403256ee11d088956d7bb63f17b6de250f84d4eae0aa69bb606f96
-
SSDEEP
12288:cSYdPRS0RIrOycMfVPTxf1Tp64hiOCSPEpjwdCDsC62fn8HhrN7GGDWib:AxRS0whcMt7h1plUzSPE1ws56Unc5N7S
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48-383177B7595-1908183718438I46673-Abrechnung.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3852 48-383177B7595-1908183718438I46673-Abrechnung.exe 3852 48-383177B7595-1908183718438I46673-Abrechnung.exe