Analysis
-
max time kernel
95s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2024 18:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
6c9e7815208530b2574368f8a70e5790
-
SHA1
61d5d998abbbfe9c6efd9d38b8c99a3b48f8a7de
-
SHA256
c0f8b5afad6fab4136affd308519c36e3779d597413d00e79e7f939bd7bae782
-
SHA512
013b6ce1104d05cdd4587197c4e177ef13409db9c81084551450674833d3876a050035a4545a647a257538a2cb44aafaada534c9bfe8e2b5bcf6a9f2dcff134d
-
SSDEEP
12288:o6MAg23QY02Vmv+TmTT8GlTiWqRZ6KTNnGP+l9+dMR4WrEXpPRTt+WHI9D1shsoY:oKsnZZvqmUNssUdHH5TI/DE/ScisNE
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 2964 set thread context of 1380 2964 file.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3616 1380 WerFault.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exefile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
file.exedescription pid process target process PID 2964 wrote to memory of 1672 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1672 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1672 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe PID 2964 wrote to memory of 1380 2964 file.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1672
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 5403⤵
- Program crash
PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 13801⤵PID:1900