Resubmissions

24-09-2024 17:26

240924-vz7bjayenb 3

24-09-2024 17:07

240924-vnfdnsvbnp 5

Analysis

  • max time kernel
    590s
  • max time network
    439s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 17:26

General

  • Target

    readerdc_tr_xa_install.exe

  • Size

    1.2MB

  • MD5

    d182ad4757d763b78b3c2aaa4cf73a34

  • SHA1

    64c16c9e208479da264518a6d0ea9930de544f09

  • SHA256

    8267bc0f07e64a7552bd50c3722189a8b816d0b3f8600f2b5adf45d97fe65157

  • SHA512

    ebe62855755dff1efa98f12291c7ada2a3ec67c90e81a691e86628a1e4211e45a040d2ebddba8134f92e7b477412e8aaf5de8a04436c82b9cd61fe1f731baab7

  • SSDEEP

    24576:3AIjJ+e0bURnfR3v6TTF/BUIsBEBGjrxIoMuAIZJ2ndsyHdU+MXyt:3l4e06nZAjQBvhIIyndsy94G

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\readerdc_tr_xa_install.exe
    "C:\Users\Admin\AppData\Local\Temp\readerdc_tr_xa_install.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1140-0-0x0000000000CF0000-0x000000000111F000-memory.dmp

    Filesize

    4.2MB

  • memory/1140-1-0x0000000000BC0000-0x0000000000BC3000-memory.dmp

    Filesize

    12KB

  • memory/1140-7-0x0000000000BC0000-0x0000000000BC3000-memory.dmp

    Filesize

    12KB

  • memory/1140-6-0x0000000000CF0000-0x000000000111F000-memory.dmp

    Filesize

    4.2MB